Which option is used to verify that a change does not adversely impact security?

Which option is used to verify that a change does not adversely impact security?

• A. Public release notes
• B. Functionality testing to verify that the change does not adversely impact the security
• C. User feedback
• D. Marketing materials

Answer: (B)

Verifying that a change does not adversely impact security comes from testing that specifically checks security implications after the change. Functional testing with a security verification focus ensures the new or updated functionality still enforces access controls, data protection, input validation, logging, and monitoring, and that no new vulnerabilities are introduced. This kind of testing provides concrete evidence that security controls remain intact after changes, which aligns with PCI DSS change-management expectations. Public release notes describe what changed but don’t validate security. User feedback can surface issues, but it isn’t a structured method to confirm security properties. Marketing materials are unrelated to verifying security impact.

Verifying that a change does not adversely impact security comes from testing that specifically checks security implications after the change. Functional testing with a security verification focus ensures the new or updated functionality still enforces access controls, data protection, input validation, logging, and monitoring, and that no new vulnerabilities are introduced. This kind of testing provides concrete evidence that security controls remain intact after changes, which aligns with PCI DSS change-management expectations.

Public release notes describe what changed but don’t validate security. User feedback can surface issues, but it isn’t a structured method to confirm security properties. Marketing materials are unrelated to verifying security impact.