PCI DSS Requirement 6: Secure Software Development and Payment Page Scripts (6.4.3)

Requirement 6 Structure

Deep Dives

• 6.2.1-6.2.4 - Secure development based on industry practices and PCI DSS; annual training for developers; code review before production; techniques to prevent injection, data-structure attacks, crypto misuse, business-logic abuse (XSS/CSRF), access-control attacks, and high-risk issues from 6.3.1.
• 6.3.1 - Identify vulnerabilities from industry sources; risk-rank including critical/high-risk to the environment; cover bespoke/custom and third-party software. This is not the same as ASV/internal scans in 11.3.x.
• 6.3.2 - Inventory of bespoke/custom software and third-party components (mandatory since 31 March 2025).
• 6.3.3 - Protect components with applicable patches: critical security patches/updates within one month of release (v4.0.1 wording); other patches within an entity-defined appropriate timeframe.
• 6.4.1 - Ongoing protection via annual (and post-significant-change) application security assessment or an automated technical solution that continually detects/prevents web attacks. 6.4.2 makes the automated continual solution mandatory after 31 March 2025 (replacing 6.4.1).
• 6.4.3 - All payment page scripts loaded/executed in the consumer browser: confirm each is authorized; assure integrity; maintain an inventory with written justification. Applies to first- and third/fourth-party scripts. Mandatory since 31 March 2025.
• 6.5.1-6.5.3 - Documented change control (reason, security impact, approval, testing, back-out; custom code tested vs 6.2.4); confirm applicable PCI DSS requirements after significant change; separate pre-production from production with access controls.

How CyberSilo Helps

• Threat Exposure Management - vulnerability and web exposure evidence
• Agentic pentesting - complements Req 6 web controls; formal pentest obligations live primarily under Requirement 11
• Compliance Standards Automation - SDLC, patch, and 6.4.3 inventory evidence

Frequently Asked Questions

What is the difference between 6.4.3 and 11.6.1?

6.4.3 manages authorization, integrity, and inventory of payment page scripts loaded in the consumer browser. 11.6.1 (covered in a later Requirement 11 guide) adds change-and-tamper detection for payment pages/HTTP headers as received by the browser.

Does 6.3.3 require all high patches within 30 days?

Under PCI DSS v4.0.1, the one-month install window applies to critical vulnerabilities (PCI SSC reverted the earlier “critical or high” wording). Other applicable patches follow a timeframe you define.

Who owns third-party payment page scripts?

6.4.3 applies to scripts loaded from your environment and from third/fourth parties. You still need authorization, integrity assurance, and a justified inventory for each script.

Related PCI Resources

PCI DSS hub · PCI DSS v4.0.1: What Changed · USA v4.0.1 services