What Will My QSA Ask For Under PCI DSS 6.4.3 & 11.6.1?
Your QSA asks for two separate records under PCI DSS 6.4.3 & 11.6.1. For 6.4.3, an authorisation record: an inventory of every payment-page script that executed, a written justification per script, who authorized it, and its integrity. For 11.6.1, a change-detection record: the pages in scope, the headers and page properties evaluated, the frequency, every change detected, and proof that personnel were alerted. This video also covers the five most common reasons evidence comes back, from one merged report to a dashboard screenshot, and the scope and alert details that shorten the conversation.
Full answer: Weekly evidence packs | Script Monitoring Platform
Transcript
Two separate records. For 6.4.3: every payment-page script, a written justification for each, who authorized it, and its integrity. For 11.6.1: the pages in scope, what's evaluated, how often, every change, and proof a person was alerted. Script Monitoring is one tag that watches every script on your payment pages, in every session, and turns it into that evidence. 6.4.3 is an authorization record: what's allowed on the page, and why. 11.6.1 is a change-detection record: what changed, and who was told. An assessor asks about them separately. For 6.4.3: an inventory of every script that executed, including the ones your vendors loaded. A written justification per script. A record of who authorized it. And its integrity, pinned to the payload, not the URL. For 11.6.1: the pages in scope, the headers and page properties evaluated, the frequency, every change detected in the period, and proof personnel were alerted. That last one is the one teams forget. What makes evidence come back? One merged report for both. A justification like Analytics, or one per vendor. An inventory from memory that misses vendor-loaded scripts. A dashboard screenshot. And detection with no recorded alert. The screenshot fails because assessments look backwards at a period, and a live dashboard shows the present. Hand over an artefact for that period, kept long enough to survive. Details that help: list every page in scope with the rule that matched it, and excluded pages with the reason. Record acknowledgement, because an unacknowledged alert is a different finding from never being told. And a week with no data should say so. Script Monitoring generates this every week: one PDF, with the 6.4.3 inventory and the 11.6.1 header changes kept distinct, plus the alerts and who was told. Packs are kept eighteen months. Evidence packs are on every plan, Free too, at 1,000 page views a month. Pro starts at $99 a month. Start for free at scriptmonitoring.com.