PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 11 / c11.4
Efficient Application SecuritySecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 🤝 SharedAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c11.4 Detection of unauthorized changes on payment pages

Detect and alert on unauthorized changes or tampering of the HTTP headers and the content of payment pages as received by the consumer's browser (new in v4.0).

Quick Wins
Foundational
Efficient
Optimized
Effort: High Impact: Medium Applies to CDE: Yes

Requirement 11

Test Security of Systems and Networks Regularly

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

11.6 Unauthorized changes on payment pages are detected and responded to
  • 11.6.1 Change/tamper detection on payment pages alerts on modifications Roadmap

How to implement on AWS

Implement script and header integrity monitoring mechanisms (e.g. CSP with reporting, Subresource Integrity, tamper detection) serving the page via CloudFront. Send violation reports to a monitored endpoint (API Gateway/Lambda) and alert. Evaluate the page content at least every 7 days.

Practical implementation

How this control is implemented in each reference architecture:

Detect skimming/tampering of payment-page scripts and headers as received by the browser, and alert on changes (new in v4.0).

  1. Serve payment pages via CloudFront and add response security headers (CSP with reporting) and Subresource Integrity (SRI) on scripts.
    Public subnet / edge CloudFront
  2. Send CSP violation / integrity reports to a monitored endpoint (API Gateway + Lambda) and raise an alert.
    Account automation API Gateway AWS Lambda EventBridge
  3. Evaluate the payment-page script/header inventory at least every 7 days (or the frequency from a targeted risk analysis).
    Account automation AWS Lambda

How to validate: CSP/SRI are set on the payment page, violation reports reach the endpoint and alert, and there is evidence of at-least-weekly evaluation.

Avoid: Trusting third-party scripts on the payment page without integrity checks. Use SRI + CSP reporting so injected/altered scripts trigger an alert.

Single-account, 3-tier →

Standardize the tamper-detection mechanism across every account that hosts payment pages, reporting to a central endpoint.

  1. Apply the same CloudFront CSP/SRI pattern to every CDE account that serves payment pages.
    Each payment-page CDE account CloudFront
  2. Deliver violation reports to a central monitoring endpoint (API Gateway/Lambda in a shared account).
    Security tooling / shared account API Gateway AWS Lambda
  3. Alert through the security tooling account so payment-page tampering anywhere is caught consistently.
    Security tooling account EventBridge Security Hub

How to validate: Every payment-page account applies CSP/SRI, and violation reports from all of them reach the central endpoint and alert.

Avoid: Per-account, divergent tamper detection. Standardize the mechanism and centralize reporting so nothing is missed.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineobserve

Testing procedures

  • Examine settings and monitoring results to verify a change- and tamper-detection mechanism is deployed on payment pages and configured per the requirement (11.6.1.a, 11.6.1.b).
  • Examine configurations and interview personnel to verify the mechanism functions at least once weekly or at the frequency set by a targeted risk analysis (11.6.1.d).

Evidence in AWS

  • CSP/SRI configuration and the tamper-detection mechanism on the payment page.
  • Report-receiving endpoint (API Gateway/Lambda) and associated alarms.
  • Evidence of evaluation at least every 7 days.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 11.6 — E-commerce skimming code or techniques cannot be added to payment pages as received by the consumer browser without a timely alert being generated.

AWS services

Amazon CloudFront AWS Lambda Amazon API Gateway Amazon CloudWatch

Learning resources

References

  • PCI DSS v4.0.1 Requirement 11.6