After a PCI DSS 4.0 audit, keep monitoring by turning each control into a recurring check with an owner, a schedule and stored output. Pay special attention to payment page scripts, where requirements 6.4.3 and 11.6.1 have been mandatory since 31 March 2025, and to anything that changes your scope between assessments.
Why does compliance drift after a pass?
An assessment looks at a window of time. The week after it, someone adds a marketing tag to the checkout page, a server is cloned without its hardening, an engineer gets admin rights for a project and keeps them. None of these is dramatic. Together they are how a company that passed in March looks very different by September.
The standard version most teams work from today is PCI DSS v4.0.1, which the PCI Security Standards Council lists in its document library alongside a summary of changes from v4.0.
What changed on 31 March 2025?
PCI DSS v4.0 introduced requirements marked as future dated best practices. According to the Council, they became required and must be fully considered in an assessment after 31 March 2025. Two of them concern e-commerce payment pages: 6.4.3 and 11.6.1.
The Council's summary of their purpose is to reduce e-skimming, where malicious scripts in a customer's browser steal card data. Its key points: scripts on payment pages must be authorized, checked for integrity and monitored for tampering, and unauthorized changes to those pages must be prevented. The Council also notes that SAQ A merchants have a different route and instead confirm their site is not susceptible to script based attacks, which can be done through the merchant, a third party or a compliant provider.
Read the standard itself for exact wording. We are summarizing the Council's published explanation, not the text of the requirement.
What should you monitor between audits?
Pick checks that would catch the drift above.
- Payment page scripts. Keep an inventory of every script that loads on payment pages, with a reason and an owner. Alert when a new one appears or an existing one changes.
- Scope changes. New systems, new vendors and new data flows can pull more of your estate into scope. Review them when they happen.
- Access. Review who has administrative rights on in scope systems on a fixed schedule, and compare against the last review.
- Vulnerabilities. Track open findings on in scope systems with age and owner. Include open source libraries in your own code, not only servers.
- Configuration. Compare live settings against your hardening baseline and record exceptions with an expiry date.
- Logs. Confirm that logging is still on and that alerts still route to someone who reads them.
How do you make it sustainable?
- List every requirement your assessor tested last cycle.
- For each one, write the recurring check that would show it still holds.
- Assign one owner per check, not a team.
- Decide the frequency by how fast the thing can change. Script inventories deserve weekly, or on every release. Access reviews can be quarterly.
- Store results somewhere durable with dates, so the next assessment starts with evidence instead of a hunt.
- Run a short internal review every quarter. Pick five controls at random and prove each with a dated artifact.
- Treat a failed check as a ticket with a due date, not a surprise at renewal.
Where do tools help, and where do they not?
Scanners and connectors are good at the repetitive part: reading configuration, listing open vulnerabilities, collecting access lists. They do not decide your scope or judge a business justification for a script. Safeguard's documentation says automated tests are mapped for PCI DSS, among other frameworks, using the systems you connect, and that each framework page says which requirements a scan decides and which need your evidence. Safeguard does not certify you or replace a qualified assessor.
Quick check
Are 6.4.3 and 11.6.1 optional now?
No. The PCI Security Standards Council says they became required after 31 March 2025, with a separate route for SAQ A merchants.
How often should we check payment page scripts?
Often enough that an unauthorized change cannot sit unnoticed. Many teams check on every release and run a scheduled weekly check as a backstop.
Sources
- PCI Security Standards Council document library
- PCI SSC blog: guidance for e-commerce requirements effective after 31 March 2025
- Safeguard docs: compliance
Last reviewed: 18 October 2026.
