---
description: A step-by-step PCI DSS 4.0 readiness checklist for payment page client-side security, covering Requirements 6.4.3 and 11.6.1.
---

# PCI DSS Checklist

A practical readiness checklist for the two PCI DSS 4.0 client-side security requirements. The steps are grouped by the requirement each one satisfies. Each links to the relevant guide.

!!! note
    This checklist is a practical aid, not compliance advice. Your QSA is the authority on what satisfies each requirement in your environment.


## Requirement 6.4.3 — authorise, assure integrity, inventory

- [ ] Identify every page where cardholder data is entered (your payment or parent pages)
- [ ] Inventory every script executing on those pages with [Script Watch](/setup/script-watch/)
- [ ] Remove any script that has no written business or technical justification
- [ ] Record a justification for each script that remains
- [ ] Authorise the remaining scripts with a [Content Security Policy](/setup/csp/) (report-only is sufficient for compliance), built with the [CSP Wizard](/setup/wizard/)
- [ ] Restrict `connect-src` and `form-action` to limit where the page can send data
- [ ] Assure script integrity with SRI via [CSP Integrity](/setup/csp-integrity/) or [Integrity Policy](/setup/integrity-policy/)


## Requirement 11.6.1 — detect and evidence change

- [ ] Add a reporting endpoint to your CSP so violations are captured from real browsers
- [ ] Enable [Script Watch](/setup/script-watch/) alerts for changes to payment page scripts
- [ ] Enable [Policy Watch](/setup/policy-watch/) alerts for changes to your security headers and CSP
- [ ] Enable [Data Watch](/setup/data-watch/) to flag unexpected data destinations
- [ ] Set an appropriate alert threshold and notification address for each watcher
- [ ] Confirm alerts reach the right people (email and/or [webhook](/integrations/webhooks/))


## Evidence for your assessor

The [PCI DSS 6.4.3 & 11.6.1 evidence pack](https://report-uri.com/pci-dss-evidence-pack) maps each requirement to the evidence below, ready to hand to your QSA.

- [ ] Export the current script inventory with authorisation status and timestamps
- [ ] Export change logs showing what changed, when, and what it changed from
- [ ] Export your CSP violation history — what was reported (and, in enforcing mode, blocked) over the period
- [ ] Confirm the above covers the full assessment period, not a single point in time


## Next steps

Work through the detailed guides for each requirement:

- [PCI DSS 6.4.3](/compliance/pci-dss-6-4-3/)
- [PCI DSS 11.6.1](/compliance/pci-dss-11-6-1/)

**New to Report URI?** These capabilities are available on a Business plan or higher, or free during your trial month — [create a free account](https://report-uri.com/register/) to get started.