PCI DSS requirement 6.3.3 says critical or high-security patches and updates must be installed within one month of release. Other applicable patches go in within an appropriate time frame the entity decides, for example three months. "Critical or high" is set by your own risk ranking under 6.3.1. This is not legal advice.
What the text says
The SAQ D wording for 6.3.3 protects all system components from known vulnerabilities by installing applicable patches as follows: critical or high-security patches identified through the 6.3.1 ranking process are installed within one month of release, and all other applicable patches within a time frame determined by the entity, with three months given as an example.
Two details are easy to miss. The clock starts at patch release, not at your discovery. And "system components" is broad, so libraries, base images and operating systems are all candidates.
A simple decision table
| Situation | Rank from 6.3.1 | Target under 6.3.3 |
|---|---|---|
| Vendor fix released for a vulnerability your process ranks critical | Critical | Install within one month of release |
| Fix released for a high-risk issue in a library you ship | High | Install within one month of release |
| Fix released for a low-risk issue | Other | Within the period you define, such as three months |
| No fix exists yet | Any | Document the risk and any mitigation, and watch for the fix |
The last row is judgement, not text from the standard. Record the reasoning so an assessor can follow it.
How to make one month realistic
- Track the release date of each patch next to the finding, not just the discovery date.
- Rank on arrival so the one month clock is visible. Our guide to ranking vulnerabilities for 6.3.1 covers the method.
- Prefer fixes that raise a version over code changes, because they ship faster.
- Keep a path for urgent releases that skips the normal sprint queue.
- Retest after patching and keep the evidence.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how available fixes are shown.
Quick check
Is the one month deadline counted from when I found the issue?
The SAQ D text says "within one month of release", which refers to the release of the patch or update.
Does 6.3.3 cover third-party libraries?
It covers all system components and related software. Applicable libraries in your payment applications belong in scope for your patch process.
On Safeguard: reachability analysis helps show which vulnerable packages your code can actually call, and autonomous remediation can open fix pull requests. It is off by default and every category starts on Manual. Try the free scan at gold.safeguard.sh/scan.
Sources
- PCI DSS v4.0 SAQ D for Merchants (PCI SSC, April 2022)
- Just Published: PCI DSS v4.0.1 (PCI SSC blog)
The text above is from v4.0. Confirm wording in v4.0.1.
Last reviewed: 19 October 2026.
