This paper examines a change control application when implemented to prevent malware, provide file integrity monitoring and control software configurations of distributed, remote systems. This paper provides guidance for internal auditors, information security specialists, and Payment Card Industry qualified security assessors (QSAs) related to the implementation of the software in PCI DSS-compliant environments. For this evaluation, the current PCI Data Security Standard (PCI DSS)1 was used. We analyze the individual PCI DSS requirements related to security of highly distributed, remote systems as seen in large retail environments.