What Do PCI DSS 6.4.3 & 11.6.1 Require?

Transcript

PCI DSS 6.4.3 asks you to authorize, integrity-check and justify every script on your payment pages. 11.6.1 asks you to detect unauthorized changes to those pages and their HTTP headers, and alert a person, at least every seven days. Script Monitoring is one tag that watches every script on your payment pages, in every session, and turns it into this evidence. Both have been mandatory since 2025, because card skimming doesn't touch your servers. It runs in your customer's browser. 6.4.3 applies to all payment page scripts that are loaded and executed in the consumer's browser. That includes scripts your vendors load, not just the ones you added. An assessor looks for three things, separately. One, authorized: a review step and a record of who approved what. Two, integrity: a vendor can change a file without changing its address, so pin the payload hash you approved, not the URL. Three, the inventory: a written justification per script, not per vendor. Analytics is not a justification. Measures checkout completion rate, required by the growth team, reviewed quarterly, is. 11.6.1 asks for a change- and tamper-detection mechanism. It must alert personnel to unauthorized modification of the HTTP headers and the contents of your payment pages, as received by the consumer browser, at least once every seven days. In practice, keep a weekly record of every distinct value seen per header. Two values means something changed. And the alert is the deliverable: a dashboard nobody opened is not an alert. What do you hand your QSA? Two records, kept separate. For 6.4.3: the inventory, a justification per script, who authorized it, and its integrity. For 11.6.1: the pages and headers checked, how often, every change, and proof a person was alerted. Script Monitoring builds both from real sessions into a weekly evidence pack, with the two records kept distinct, retained eighteen months. 6.4.3 & 11.6.1 are on every plan, Free too, at 1,000 page views a month. Pro starts at $99 a month. Start for free at scriptmonitoring.com.