PCI DSS v4.0/Requirement 06: Develop and Maintain Secure Systems and Software/91 of 250
6.4.3Public-facing web applications are protected against attacks
Control family: Requirement 06: Develop and Maintain Secure Systems and Software
Control description
Defined Approach Requirements:
All payment page scripts that are loaded and executed in the consumer's browser are managed as follows:
- A method is implemented to confirm that each script is authorized.
- A method is implemented to assure the integrity of each script.
- An inventory of all scripts is maintained with written justification as to why each is necessary.
Defined Approach Testing Procedures:
6.4.3.a Examine policies and procedures to verify that processes are defined for managing all payment page scripts that are loaded and executed in the consumer's browser, in accordance with all elements specified in this requirement.
6.4.3.b Interview responsible personnel and examine inventory records and system configurations to verify that all payment page scripts that are loaded and executed in the consumer's browser are managed in accordance with all elements specified in this requirement.