Which elements should be included in documented change control procedures?

• A. Documentation of impact
• B. Documented change approval by authorized parties
• C. Functionality testing to verify the change does not adversely impact security
• D. All of the above

Answer: (D)

Change control procedures in PCI environments must be formal and documented to prevent unplanned changes that could compromise security. Documenting impact ensures you understand which systems, data, and controls are affected and what risks the modification introduces. Having the change approved by authorized parties provides accountability and ensures the change aligns with security policies and business goals. Functionality testing verifies that the change behaves as intended and does not degrade security controls or create new vulnerabilities. Because each of these steps addresses a different risk area—planning, authorization, and verification—the most complete, safe approach is to include all of them in the change control process.