6.3 Security vulnerabilities are identified and addressed
How to meet it
Track vulnerabilities (incl. dependencies), rank by risk, and patch critical ones within one month.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 6.3, in plain English.
6.3.1Security vulnerabilities are identified from industry sources and assigned a risk ranking, flagging all high-risk or critical issues.
6.3.2An inventory of bespoke/custom software and the third-party components in it is kept for vulnerability and patch management.
6.3.3System components are protected from known vulnerabilities by patching, with critical patches within one month and others on a risk-based timeframe.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Vulnerability and patch management policyUse for ISO 27001 A.8.8, A.8.19, A.8.32, SOC 2 Security, and PCI DSS requirements 6 and 11.Asset management policyUse for ISO 27001 A.5.9, A.5.10, A.5.11, A.7.9 to A.7.14, SOC 2 Security, and PCI DSS asset inventory expectations.Information security roles and responsibilitiesUse for ISO 27001 A.5.2, A.5.3 and A.5.4, defining security roles, segregation of duties, management responsibilities, and SOC 2 organisational controls.Supplier security policyUse for ISO 27001 A.5.19 to A.5.23, SOC 2 vendor management, cloud services, and AI supplier reviews.
Open the control-to-policy map← 6.2 Bespoke and custom software is developed securely6.4 Public-facing web applications are protected against attacks →
Back to Requirement 6, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.