PCI Req 6: Secure Systems & Software Development (AppSec)

Tap to enlarge

Complete the Identity fields. Each value is validated against the schema before the next step unlocks.

• Domain entity ID (required)

  entityId

  The organisation or system this record is about — lowercase with dashes, e.g. acme-corp-hq. Pick one you have used before, or type a new id to create it.

Tap to enlarge

Complete the Technical controls fields. Each value is validated against the schema before the next step unlocks.

• SBOM Components › Package name (required)

  sbomPackages.packageName

  Enter package name.

• Payment page script integrity (Req 6.4.3) › Script URL or location (required)

  paymentPageScripts.scriptUrl

  Enter script url or location.

• SBOM Components › Package version (required)

  sbomPackages.version

  Enter package version.

• Payment page script integrity (Req 6.4.3) › Documented business justificationoptional

  paymentPageScripts.businessJustification

  Enter documented business justification.

• SBOM Components › Critical CVEs countoptional

  sbomPackages.criticalVulnerabilitiesCount

  Enter critical cves count.

• Payment page script integrity (Req 6.4.3) › Script authorized for production executionoptional

  paymentPageScripts.authorized

  Enter script authorized for production execution.

• SBOM Components › Age of oldest critical CVE (days)optional

  sbomPackages.oldestCriticalAgeDays

  Enter age of oldest critical cve (days).

• Payment page script integrity (Req 6.4.3) › Subresource Integrity (SRI) SHA digestoptional

  paymentPageScripts.sriHash

  Enter subresource integrity (sri) sha digest.

• Payment page script integrity (Req 6.4.3) › Content Security Policy (CSP) hash or nonce restriction enforcedoptional

  paymentPageScripts.cspEnforced

  Enter content security policy (csp) hash or nonce restriction enforced.

• Payment page script integrity (Req 6.4.3) › Client-side runtime tamper and anomaly alerts activeoptional

  paymentPageScripts.tamperAlertsActive

  Enter client-side runtime tamper and anomaly alerts active.

• SSDLC processes documented and enforced (Req 6.2.1)optional

  ssdlcDocumented

  Enter ssdlc processes documented and enforced (req 6.2.1).

• Developer secure coding training recency (days)optional

  developerTrainingRecencyDays

  Enter developer secure coding training recency (days).

• Mandatory peer code review prior to release (Req 6.2.3)optional

  codeReviewEnforced

  Enter mandatory peer code review prior to release (req 6.2.3).

• Software component and library inventory / SBOM maintained (Req 6.3.2)optional

  sbomInventoryMaintained

  Enter software component and library inventory / sbom maintained (req 6.3.2).

• Critical patch deployment SLA in days (max 30)optional

  criticalPatchSlaDays

  Enter critical patch deployment sla in days (max 30).

• SBOM Componentsoptional

  sbomPackages

  Enter sbom components.

• Public web application protection method (Req 6.4.1/6.4.2)optional

  publicWebAppProtectionMode

  Enter public web application protection method (req 6.4.1/6.4.2).

• WAF active traffic inspection and blocking enabled (Req 6.4.2)optional

  wafInspectionActive

  Enter waf active traffic inspection and blocking enabled (req 6.4.2).

• Payment page script integrity (Req 6.4.3)optional

  paymentPageScripts

  Enter payment page script integrity (req 6.4.3).

• Test and production environments completely segregated (Req 6.5.1)optional

  testAndProdSeparated

  Enter test and production environments completely segregated (req 6.5.1).

• Live cardholder data strictly prohibited in test environments (Req 6.5.2)optional

  livePanInTestProhibited

  Enter live cardholder data strictly prohibited in test environments (req 6.5.2).

Tap to enlarge

Complete the Remediation fields. Each value is validated against the schema before the next step unlocks.

• Remediation items › Finding referenceoptional

  remediationItems.findingId

  Enter finding reference.

• Remediation items › Requirement that failed its testing procedureoptional

  remediationItems.controlId

  Enter requirement that failed its testing procedure.

• Remediation items › Accountable owneroptional

  remediationItems.owner

  Enter accountable owner.

• Remediation items › The owner is a named individual, not a team or distribution listoptional

  remediationItems.ownerIsNamedIndividual

  Enter the owner is a named individual, not a team or distribution list.

• Remediation items › Days until due (negative when overdue)optional

  remediationItems.dueInDays

  Enter days until due (negative when overdue).

• Remediation items › Risk rankingoptional

  remediationItems.riskRank

  Enter risk ranking.

• Remediation items › Risk ranking overridden by handoptional

  remediationItems.riskRankOverridden

  Enter risk ranking overridden by hand.

• Remediation items › Reason for the overrideoptional

  remediationItems.riskRankOverrideReason

  Enter reason for the override.

• Remediation items › Approver of the overrideoptional

  remediationItems.riskRankOverrideApprover

  Enter approver of the override.

• Remediation items › Remediation performedoptional

  remediationItems.remediationClaimed

  Enter remediation performed.

• Remediation items › Days since the change was madeoptional

  remediationItems.remediationClaimedDaysAgo

  Enter days since the change was made.

• Remediation items › Original testing procedure re-executedoptional

  remediationItems.originalTestingProcedureReExecuted

  Enter original testing procedure re-executed.

• Remediation items › The original test drew a sampleoptional

  remediationItems.originalTestUsedSampling

  Enter the original test drew a sample.

• Remediation items › The re-test sampled againoptional

  remediationItems.reSampled

  Enter the re-test sampled again.

• Remediation items › Verified byoptional

  remediationItems.verifiedBy

  Enter verified by.

• Remediation items › Verification evidence referenceoptional

  remediationItems.verificationEvidenceRef

  Enter verification evidence reference.

• Remediation items › Days since the verification evidence was producedoptional

  remediationItems.verificationEvidenceDaysAgo

  Enter days since the verification evidence was produced.

• Remediation items › Interim risk acceptance in forceoptional

  remediationItems.riskAccepted

  Enter interim risk acceptance in force.

• Remediation items › Days until the acceptance expiresoptional

  remediationItems.riskAcceptanceExpiresInDays

  Enter days until the acceptance expires.

• Remediation itemsoptional

  remediationItems

  Enter remediation items.

Tap to enlarge

Complete the Approach fields. Each value is validated against the schema before the next step unlocks.

• Assessment Approachoptional

  approachType

  Enter assessment approach.

• Customized Approach Justification / TRA Referenceoptional

  customizedApproachJustification

  Enter customized approach justification / tra reference.

Tap to enlarge

Complete the Verdicts fields. Each value is validated against the schema before the next step unlocks.

• Total Controls Evaluatedoptional

  totalControlsEvaluated

  Enter total controls evaluated.

• Controls In Placeoptional

  controlsInPlace

  Enter controls in place.

• In Place with Compensating Controloptional

  controlsInPlaceWithCcw

  Enter in place with compensating control.

• Controls Not Applicableoptional

  controlsNotApplicable

  Enter controls not applicable.

• Controls Not In Placeoptional

  controlsNotInPlace

  Enter controls not in place.

• Controls Not Testedoptional

  controlsNotTested

  Enter controls not tested.