PCI-DSS v4.0 Evidence Report
Change control evidence for PCI-DSS Requirement 6.5 — change management procedures, post-change compliance verification, environment separation, and separation of duties.
Overview
PCI-DSS v4.0 is the payment card industry standard for organizations that store, process, or transmit cardholder data. Requirement 6 covers secure software development and change management.
Koalr's PCI-DSS report focuses on four sub-requirements under 6.5 ("Changes to all system components are managed securely") that are directly evidenced by engineering change management data. The report is designed for delivery to a Qualified Security Assessor (QSA).
Requirements covered
6.5.1 — Change Management Procedures
Requirement: Changes to all system components in the production environment are made according to established change control procedures.
Koalr evidence: Every merged change has peer review, risk assessment, and documented approval before production deployment.
6.5.2 — Post-Change Compliance Verification
Requirement: Upon completion of a significant change, all applicable PCI DSS requirements are confirmed.
Koalr evidence: Automated risk scoring flags high-impact changes (DDL, blast radius, CODEOWNERS violations) for mandatory review.
6.5.3 — Separation of Environments
Requirement: Pre-production environments are separated from production environments, and the separation is enforced with access controls.
Koalr evidence: CODEOWNERS rules enforce authorized reviewer approval on every protected-branch merge. Merges that bypass required reviewers are treated as access control exceptions.
6.5.4 — Separation of Duties
Requirement: Roles and functions are separated between production and pre-production environments to provide accountability such that only reviewed code is deployed.
Koalr evidence: Authors cannot self-approve their own PRs. Rubber-stamp approvals (approved under 2 minutes with zero review comments) are detected and flagged as separation-of-duties exceptions.
Report output
- Dark navy cover page with PCI-DSS requirement badges (6.5.1, 6.5.2, 6.5.3, 6.5.4) and metadata block prepared for Qualified Security Assessor (QSA)
- Executive summary with six KPI tiles
- Per-requirement detail blocks with status badge and evidence count
- Change log table with approval, CODEOWNERS, and risk columns
- Page number footer with CONFIDENTIAL marking
- Machine-readable CSV export
Generating a report
- Navigate to Compliance → PCI-DSS v4.0
- Select your reporting period (typically aligned with your assessment scope)
- Click Download evidence package (PDF) or Export CSV
QSA review notes
- The PDF cover page names "PCI-DSS Qualified Security Assessor (QSA)" in the Prepared For field
- Evidence is scoped to your connected GitHub organization — ensure only in-scope repositories (those handling cardholder data or supporting CDE) are included
- For full PCI-DSS assessment, pair Koalr's change management evidence with network scans, vulnerability reports, and access reviews
Integration requirements
- GitHub (required) — provides all change management data
- Scope tagging: use Koalr repository groups to segment in-scope vs out-of-scope repositories
Disclaimer
This report is designed to support PCI-DSS Requirement 6.5 evidence collection. It does not constitute a formal attestation. Engage a Qualified Security Assessor (QSA) for your PCI-DSS assessment.
ISO/IEC 27001:2022 Evidence Report
Evidence for ISO 27001 Annex A change management controls — A.8.32 Change Management, A.8.25 Secure Development Lifecycle, A.8.34 Protection During Audit Testing.
ITIL 4 — Change Advisory Board (CAB) Evidence Report
ITIL 4 Change Enablement evidence — change authorization, risk assessment, emergency change control, and complete audit trail for every merged change.