If you’re in charge of PCI compliance at your organization, you likely have a lot of questions about PCI requirements 6.4.3 and 11.6.1. Choosing the best solution can be difficult, especially if you don’t understand what your options are. Continue reading this blog to learn about the new requirements and the solutions offered to achieve compliance.

Overview of PCI DSS requirements 6.4.3 and 11.6.1.

The new requirements of 6.4.3 and 11.6.1 have caused some confusion amongst businesses who want to know their new PCI responsibilities. Enterprise organizations face compliance challenges related to the size of their organization, their network complexity, and business operations. Here is a brief synopsis of the new requirements 6.4.3 and 11.6.1. 

6.4.3: Documentation of Changes

The 6.4.3 PCI requirement ensures that any changes made to the cardholder data environment (CDE) are properly documented. This is part of the broader requirement to implement formal change control processes (Requirement 6.4).

Documentation for 6.4.3 include:

• Small businesses must clearly log and describe changes. 
• The documentation should include the nature of the change, the person(s) authorizing the change, and any relevant testing or validation conducted prior to implementation.

This helps maintain accountability and enables organizations to track modifications that could impact security.

11.6.1: Integrity Monitoring Tools

This requirement mandates the use of file integrity monitoring (FIM) tools to ensure the integrity of critical files, configurations, and data. It focuses on detecting unauthorized changes that might signal a security breach or tampering.

Key aspects:

• FIM tools must be deployed to monitor changes in files or configurations in the CDE.
• Regular reviews of the monitoring alerts are required to identify and respond to suspicious activity promptly.
• These tools are critical for maintaining security and ensuring that no malicious changes compromise sensitive systems.

By implementing these requirements effectively, businesses can strengthen their change control processes and ensure the integrity of their systems, reducing the risk of vulnerabilities and breaches.

Tools For Meeting Requirements 6.4.3 and 11.6.1 

SecurityMetrics has several solutions for meeting these new requirements, including Shopping Cart Inspect and Shopping Cart Monitor. 

Shopping Cart Inspect

Shopping Cart Inspect is excellent for detecting vulnerabilities early. Inspect is a manual inspection of your ecommerce website's shopping cart by a SecurityMetrics Forensic Investigator. The process involves the use of Patented, Award-winning WIM Technology to quickly determine if your website has fallen victim to javascript skimming.

SecurityMetrics Forensic Analysts will create a risk report illustrating your risk rating. Your thorough risk report will include:

• A prioritized list of vulnerabilities
• A ranking of your vulnerabilities from medium to high-risk based on the CVSS scale
• Description of malicious javascript
• Identification of suspicious URLs on your website
• A list of third-party domains participating in your ecommerce experience
• Expert remediation recommendations and techniques 
• 24/7 technical support for remediation 

Using your risk report, you can obtain an overall understanding of your ecommerce website’s structural integrity.

Shopping Cart Monitor

Shopping Cart Monitor is code-free or a no-code required solution. This means that you benefit from: 

• No software installation
• No software integration
• No website configurations

A code-free (or agentless) solution doesn’t require involving your web development team, which an agent-based solution would. In addition, it greatly improves your security because it can't be subverted. Monitor, unlike an agent-based solution that can be manipulated to be subverted, uses no code on your site, so it cannot be tampered with.

Shopping Cart Monitor helps you reach 6.4.3 by inventorying your javascript. Any javascript on the page is inventoried and documented in order to meet PCI requirement 6.4.3. Both static and dynamically generated javascripts are analyzed and inventoried.

Final Thoughts: Evaluating Compliance Solutions

Here are some final questions to ask when selecting a PCI compliance solution:

• Does it conduct dynamic DOM analysis?
• How comprehensive is the script management interface?
• Frequency and detail of reporting: Are alerts actionable or overwhelming?
• Importance of understanding the provider's expertise and methodology.
• Do I know how to configure a code-based solution? Or do I need a simpler, code-free solution? 

Whatever solution you choose for reaching 6.4.3 and 11.6.1, it’s essential to conduct thorough research and vet companies carefully, so you obtain the best product possible.