11.6 Unauthorised changes on payment pages are detected
How to meet it
Monitor payment-page scripts/headers for tampering (a v4.0 focus on e-skimming).
Defined requirements
The individual PCI DSS v4.0.1 requirements under 11.6, in plain English.
11.6.1A change- and tamper-detection mechanism alerts on unauthorized changes to payment-page HTTP headers and scripts as received by the browser, evaluated at least weekly.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Change management policyUse for ISO 27001 A.8.32, A.8.9, SOC 2 change management criteria, and PCI DSS requirement 6 change controls.Logging and monitoring policyUse for ISO 27001 A.8.15, A.8.16, A.8.17, SOC 2 Security, and PCI DSS requirements 10 and 11.Malware protection policyUse for ISO 27001 A.8.7, SOC 2 Security, and PCI DSS requirement 5 anti-malware controls.Secure development policyUse for ISO 27001 A.8.25 to A.8.32, source code controls, change management, and SOC 2 change controls.
Open the control-to-policy mapBack to Requirement 11, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.