For compliance teams walking an assessor through it
The output of a client-side control is not a dashboard, it is something you can hand over. That is what the weekly evidence pack is for.
Start for free
Talk to an expert
What does compliance and audit get from script monitoring?
Assessments look backwards at a period. The output of a client-side control is not a dashboard, it is something you can hand over. That is what the weekly evidence pack is for. The rest of this page sets out what that means day to day.
The artefact, not the interface
Assessments look backwards at a period. A live dashboard shows the present. The evidence pack is a generated PDF for a period, retained 18 months.
Two records, kept apart
6.4.3 is an authorisation record and 11.6.1 is a change-detection record. They are presented separately because an assessor asks about them separately.
Scope you can defend
Every page treated as a payment page is listed with the selector rule that matched it, and excluded pages are listed with the reason. Scope disputes get shorter.
Alerts as evidence
11.6.1 asks that personnel are alerted. Acknowledgement is recorded, and unacknowledged alerts appear in the pack, because that is a different finding from never being told.
The four things an assessor asks to see, generated weekly and kept for 18 months, which is longer than the raw data behind them.
Frequently asked questions
Read the FAQ
A PDF: scope, the script inventory with a justification per script, every security-header change with timestamps, and the alerts raised and acknowledged. Those are the four things assessors ask for.
Yes, the controls have been validated by a Qualified Security Assessor. Assessors differ on format, so if yours wants something specific it is worth raising early rather than the week before.
Generated packs are retained 18 months, which is longer than the raw script history behind them (7, 30 or 90 days by plan). Assessments look backwards, so the artefact is what needs to survive.
Yes, a quarterly attestation pack covering any period you need, in addition to the automatic weekly packs.
No, and we would rather say so. It covers 6.4.3 and 11.6.1. The other ten requirement families need a full-scope platform or your QSA's process.
Try it on your own payment pages.
Free forever on 1,000 page views a month, no credit card.
Free forever plan. No credit card.