The final thing in requirement 6 is to demand to have policies and
procedures that support all the sub requirements.
And as always, it's not just that the policies and procedures exist,
but that they're properly documented, accessible to people who need them,
and that they're actually being used.
To test this,
the QSA is going to look at the policies and the procedures and
interview the people who should know about using them.
We're going to finish this module that looked at PCI DSS
requirement and respective secure software development by
joining the discussion between Jacob and me.
We discuss some common problems in meeting these requirements,
and I think we talk quite a bit about code reviews.