11.6.1 — Payment page change and tamper detection

Requirement

A change- and tamper-detection mechanism alerts personnel to unauthorised modification of the security-impacting HTTP headers and script contents of payment pages as received by the consumer's browser, evaluated at least once every seven days or at a frequency set by targeted risk analysis.

What the engine looks for

Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.

Equivalent controls elsewhere

Matched on shared topics. Satisfying this control usually moves these too.