Why the PCI SSC created requirements 6.4.3 and 11.6.1

The problem the requirements address

Earlier versions of PCI DSS concentrated on the systems that store, process or transmit card data: networks, servers, databases, access control and encryption. Vulnerability scans and penetration tests looked at those systems from the outside or the inside. Meanwhile, attackers moved to a place those checks do not look: the customer's browser. A malicious script on a checkout page copies card data as it is typed, before it ever reaches a protected system. This is web skimming.

The PCI Security Standards Council (PCI SSC) describes 6.4.3 and 11.6.1 as e-commerce requirements that aim to reduce e-skimming, where attackers use scripts in the shopper's browser to steal card data. In short, they ask organizations to know and authorize the scripts on their payment pages (6.4.3), and to be alerted when the pages or the security-related HTTP headers change without authorization (11.6.1).

Timeline: from v4.0 to mandatory

The requirements themselves are in PCI DSS v4.0.1, which is the current version of the standard at the time of writing. Always check the PCI SSC document library for the latest version.

What each requirement does

6.4.3: manage the scripts

Requirement 6.4.3 is about control. For payment page scripts that run in the consumer's browser, an organization must have a way to confirm each script is authorized, a way to assure its integrity, and an inventory of all scripts with a written business or technical justification for each. See PCI DSS 6.4.3 explained.

11.6.1: detect change and tampering

Requirement 11.6.1 is about detection. A change- and tamper-detection mechanism must alert personnel to unauthorized modification of the HTTP headers and the content of payment pages as received by the consumer's browser, and must run at least every seven days or at a frequency set by a targeted risk analysis. See PCI DSS 11.6.1 explained.

The two work as a pair: one defines what is allowed to be on the page, and the other notices when reality stops matching it.

Who they apply to

The requirements concern entities with e-commerce payment pages. PCI DSS v4.0.1 added applicability notes making clear that they also reach a merchant's web page that includes a payment provider's embedded payment form, for example in an iframe. At the same time, how the requirements are validated differs by the way a merchant accepts payments. Merchants who qualify for SAQ A no longer list 6.4.3 and 11.6.1 as line items but must meet a related eligibility criterion; the details, and why you should confirm them with your acquirer or assessor, are in 6.4.3 and 11.6.1 for SAQ A, SAQ A-EP and SAQ D.

The PCI SSC does not enforce compliance. Card brands and acquirers set validation and reporting obligations, so your acquirer is the right party to ask what applies to you.