[PCI DSS 3.0] 6.4.4 Removal of test data and accounts before production systems become active

6.4.4 Removal of test data and accounts before production systems become active

6.4.4.a Observe testing processes and interview personnel to verify test data and accounts are removed before a production system becomes active.

6.4.4.b Examine a sample of data and accounts from production systems recently installed or updated to verify test data and accounts are removed before the system becomes active.

Test data and accounts should be removed from production code before the application becomes active, since these items may give away information about the functioning of the application or system. Possession of such information could facilitate compromise of the system and related cardholder data.