The entity must deploy a mechanism for detecting changes and tampering which: warns personnel of any unauthorized modification (changes, additions, deletions and indicators of compromise) to the HTTP headers that affect security and to the scripts in payment pages, as those arrive in the consumer's browser; is set up to assess the HTTP headers and payment pages as received; and runs its functions either at least weekly or periodically at a frequency established by a targeted risk analysis the entity performs under all elements of Requirement 12.3.1. Applicability: it also applies to entities whose webpages embed a TPSP's or payment processor's payment page or form (for example iframes), but not to the scripts inside that embedded page or form, which are the TPSP's or processor's responsibility. The entity is not expected to install software in consumer systems or browsers; it is expected to use techniques like those the Guidance column lists as examples (CSP violation reporting, synthetic user monitoring, tamper-detection script, reverse proxies or CDNs). Objective under the customized approach: skimming code cannot be introduced into payment pages as received by the browser, and anti-skimming measures cannot be removed, without a timely alert. Future-dated: treated as a best practice up to 31 March 2025 and mandatory since then.
This control maps to 31 controls across 10 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
PCI DSS 4.0 11.6.1 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.
The graph holds this control, the 31 it maps to, and the evidence behind each claim, over MCP and REST.