PCI DSS Security Maturity Model·AWS v1.0.0
Home / Matrix / Requirement 11 / r11.4
Efficient Application Security 🤝 Shared

r11.4 Detection of unauthorized changes on payment pages

Detect and alert on unauthorized changes or tampering of the HTTP headers and the content of payment pages as received by the consumer's browser (new in v4.0).

Quick Wins
Foundational
Efficient
Optimized
Effort: High Impact: Medium Applies to CDE: Yes

AWS services

Amazon CloudFront AWS Lambda Amazon API Gateway Amazon CloudWatch

Requirement 11

Test Security of Systems and Networks Regularly

PCI sub-requirements covered

  • 11.6 Unauthorized changes on payment pages are detected and responded to

How to implement on AWS

Implement script and header integrity monitoring mechanisms (e.g. CSP with reporting, Subresource Integrity, tamper detection) serving the page via CloudFront. Send violation reports to a monitored endpoint (API Gateway/Lambda) and alert. Evaluate the page content at least every 7 days.

Practical implementation

How this control is implemented in each reference architecture:

Serve payment pages via CloudFront and add script/header integrity monitoring (CSP with reporting, Subresource Integrity); send violation reports to an API Gateway/Lambda endpoint and alert. Evaluate at least weekly.

Single-account, 3-tier →

Standardize the payment-page tamper-detection mechanism across the CDE accounts that host payment pages, delivering violation reports to a central monitoring endpoint and alerting through the security tooling account.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine settings and monitoring results to verify a change- and tamper-detection mechanism is deployed on payment pages and configured per the requirement (11.6.1.a, 11.6.1.b).
  • Examine configurations and interview personnel to verify the mechanism functions at least once weekly or at the frequency set by a targeted risk analysis (11.6.1.d).

Evidence in AWS

  • CSP/SRI configuration and the tamper-detection mechanism on the payment page.
  • Report-receiving endpoint (API Gateway/Lambda) and associated alarms.
  • Evidence of evaluation at least every 7 days.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 11.6 — E-commerce skimming code or techniques cannot be added to payment pages as received by the consumer browser without a timely alert being generated.

Learning resources

References

  • PCI DSS v4.0.1 Requirement 11.6