PCI Secure Software Lifecycle v1.1

Control Objectives:
6.1 The integrity of all software code, including third-party components, is maintained throughout the entire software lifecycle.
Test Requirements:
6.1 The assessor shall examine evidence, interview personnel, and observe tools and processes to confirm: 

Guidance:
Effective software-code control practices help ensure that all changes to code are authorized and performed only by those with a legitimate reason to change the code. Examples of these practices include code check-in and check-out procedures with strict access controls, and a comparison—for example, using a checksum—immediately before updating code to confirm that the last approved version has not been changed. It is important that controls cover all software code, third-party components and libraries, configuration files, etc. that are controlled by the vendor. 
The integrity and confidentiality of these assets need to be maintained, as they often contain sensitive data such as intellectual property⎯for example, business logic—logic of security functions, configuration of cryptographic functions (e.g., white-box cryptography), etc. 

Control Objectives:
6.2 Software releases and updates are delivered in a secure manner that ensures the integrity of the updated code.
Test Requirements:
6.2 The assessor shall examine vendor evidence, interview personnel, and observe tools and processes to confirm the following: 

Guidance:
Security updates should include a mechanism within the update process to verify the updated code has not been replaced or tampered with. Examples of integrity checks include checksums and properly implemented digitally signed certificates. 
To ensure the implemented controls are adequate to address the evolving attack vectors, software vendors should perform periodic reviews to confirm their continued effectiveness.