Skip to content
MDView as Markdown

PCI DSS Checklist

A practical readiness checklist for the two PCI DSS 4.0 client-side security requirements. The steps are grouped by the requirement each one satisfies. Each links to the relevant guide.

Note

This checklist is a practical aid, not compliance advice. Your QSA is the authority on what satisfies each requirement in your environment.

Requirement 6.4.3 — authorise, assure integrity, inventory

  • Identify every page where cardholder data is entered (your payment or parent pages)
  • Inventory every script executing on those pages with Script Watch
  • Remove any script that has no written business or technical justification
  • Record a justification for each script that remains
  • Authorise the remaining scripts with a Content Security Policy (report-only is sufficient for compliance), built with the CSP Wizard
  • Restrict connect-src and form-action to limit where the page can send data
  • Assure script integrity with SRI via CSP Integrity or Integrity Policy

Requirement 11.6.1 — detect and evidence change

  • Add a reporting endpoint to your CSP so violations are captured from real browsers
  • Enable Script Watch alerts for changes to payment page scripts
  • Enable Policy Watch alerts for changes to your security headers and CSP
  • Enable Data Watch to flag unexpected data destinations
  • Set an appropriate alert threshold and notification address for each watcher
  • Confirm alerts reach the right people (email and/or webhook)

Evidence for your assessor

The PCI DSS 6.4.3 & 11.6.1 evidence pack maps each requirement to the evidence below, ready to hand to your QSA.

  • Export the current script inventory with authorisation status and timestamps
  • Export change logs showing what changed, when, and what it changed from
  • Export your CSP violation history — what was reported (and, in enforcing mode, blocked) over the period
  • Confirm the above covers the full assessment period, not a single point in time

Next steps

Work through the detailed guides for each requirement:

New to Report URI? These capabilities are available on a Business plan or higher, or free during your trial month — create a free account to get started.