Passing a PCI assessment does not mean you have a functioning PCI program. Security, engineering, compliance, operations, legal, vendors, and leadership may each own part of PCI, but somebody still needs to own the whole program between assessments.

PCI DSS 4.0.1 Control 6.4.3 (effective April 1, 2025) mandates script authorization, integrity checks, and inventory on payment pages. This guide covers the control, implementation tips, and monitoring tools like CSP headers, securityheaders.com, and Snyk.