PCI DSS Requirement 11.6.1

The Payment Card Industry (PCI) Data Security Standard (DSS) is a global standard that provides a baseline of technical and operational requirements designed to protect payment account data.

PCI DSS v4 is the current mandatory standard. While general adoption was required by April 1, 2024, the new technical requirements took full effect on April 1, 2025. This includes enforcing Requirements 6.4.3 and 11.6.1, which are designed to protect payment pages that capture account data.

PCI DSS 11.6.1 Requirements

Deployment & Scope

A mechanism must be deployed to detect changes and tampering of HTTP headers and payment page content as received by the consumer browser, ensuring security and integrity at the point of consumption.


Detection & Alerts

Personnel must be alerted to any unauthorized changes, including modifications, additions, or deletions to security-related HTTP headers, as well as any changes or additions to scripts on payment pages.


Frequency

Evaluations occur at least once every seven days OR at defined periodic intervals as established by the organization's targeted risk analysis (TRA).

Related Resources

Glossary

PCI DSS Requirement 6.4.3

The Payment Card Industry (PCI) Data Security Standard (DSS) is a global standard that provides a baseline of technical and operational requirements designed to protect payment account data. PCI DSS v4.0.1 is the current version of the standard. While general adoption was required by April 1, 2024, the new technical requirements took full effect on April 1, 2025. This includes Requirements 6.4.3 and 11.6.1, which are designed to protect payment web pages that capture account data.

Read More_ Glossary

PCI DSS v4

Amid the exponential growth of credit card fraud and data breaches, the Payment Card Industry Data Security Standard (PCI DSS) was created in 2004 by five major credit card companies: Visa, Mastercard, Discover, JCB, and American Express. According to the PCI Security Standards Council, the body responsible for developing the guidelines, the “PCI Data Security Standard (PCI DSS) is a global standard that provides a baseline of technical and operational requirements designed to protect account data.” The minimum requirements established in PCI DSS apply to all entities that handle payment card information, including merchants, service providers, and financial institutions. The latest version, PCI DSS v4, introduced key changes to address evolving cybersecurity threats and modernise the standard for today's payment ecosystem.

Read More_ Glossary

Penetration Testing (Pen Testing)

As tech gets better, hackers find new ways to break in. A successful hack can cause big problems, from stolen data to locked-up computers. It can hurt money, reputation, and even a country's safety. To fight these dangers, security experts must take action to protect their systems. One key method is Penetration Testing (Pen Testing). This involves simulating an attack to find weak spots before bad guys can use them. By finding and fixing problems, organizations can stay ahead of possible threats.

Read More_