What PCI DSS 4.0 actually asks about scripts
There is a lot of vendor content about requirements 6.4.3 and 11.6.1, most of it written to make you anxious. Here is the plain version, including the parts that are less dramatic than the marketing suggests.
6.4.3 — manage the scripts
You need a method to confirm each script on a payment page is authorized, a method to ensure its integrity, and an inventory with a written justification for why each one is there.
The word doing the work is justification. Not "we know about it" — why it exists. In practice this is the requirement that surfaces the real problem, because the exercise of writing one sentence per script is how most teams discover the scripts from the previous post.
11.6.1 — detect changes
You need a mechanism that detects unauthorized modification to the HTTP headers and content of payment pages, and alerts personnel. It should evaluate at least weekly.
"At least weekly" is the floor, and this is where honesty matters more than our commercial interest: weekly is compliant. If you implement a weekly check with real alerting, you have met the requirement. We think weekly is a poor security outcome — a week is a long time to be exfiltrating card data — but you should not confuse our argument with the standard's. Anyone telling you the standard mandates continuous monitoring is selling, and you should discount the rest of what they say accordingly.
The part people get wrong
Both requirements apply to the payment page as the consumer's browser receives it. Not the template in your repository. Not the page your CDN caches. The assembled thing, with everything the tag manager pulled in at runtime.
We have watched teams pass an assessment on evidence generated from a staging environment where the marketing tags were never installed. Technically an accurate document, describing a page no customer ever loads.
A reasonable order of operations
- Build the inventory from a real browser session on the live page.
- Write the justification sentences. Delete whatever you cannot justify — this is the cheapest security work available to you.
- Then choose a detection mechanism, and pick the frequency you can defend on the day something happens, not the one that clears the bar.
Most teams do this backwards: buy the detection tool first, then discover the inventory is the hard part. The inventory is always the hard part.