Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

PCI DSS 4.0.1 became mandatory on March 31, 2025, bringing in 47 new requirements that fundamentally changed how compliance works. Organizations that treated PCI as an annual audit exercise now face a standard that expects real-time visibility into payment pages. Requirements 6.4.3 and 11.6.1 are the most impactful additions, which require real-time visibility into scripts and payment page changes. A spreadsheet updated quarterly can’t deliver that.

Tell me if you’ve heard this one before: a company audits its checkout page and discovers 47 scripts running. Only 12 were approved. The other 35? A mystery, and a risk. Nobody knows who added them or whether they’ve been compromised. That’s what we’re here to talk about today.

PCI audits are not designed to protect your organization. They are designed to protect the payment card industry. This misalignment exists because card brands bear the burden of fraud-related costs, so the framework is built to minimize their exposure rather than address the unique risks merchants face. For example, PCI DSS focuses heavily on infrastructure and network security, reflecting a time when payment processing happened in secure, on-premise environments.

The stakes for protecting payment data have never been higher. In 2024, the global average cost of a data breach reached $4.88 million, a 10% increase over the previous year (IBM). For any business handling credit card transactions, PCI DSS compliance certification is essential to safeguard customer trust, meet regulatory obligations, and prevent costly breaches.

Running a site that processes payments can be risky. Hidden scripts from ads, chat widgets, and third parties can expose your business to security attacks, such as Magecart and e-skimming. PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1, which are mandatory as of March 31, 2025, require live script inventories, approvals, and real-time change alerts. The solution: A PCI DSS compliance software that tracks, verifies, and blocks tampering in real time.

For many U.S. companies, the answer is yes—and not just those physically located in Connecticut. Like the CCPA in California or the CPA in Colorado, the Connecticut Data Privacy Act has an extraterritorial reach, meaning if your website, SaaS platform, or e-commerce business processes Connecticut residents’ personal data at scale, compliance is mandatory. The problem? CDPA compliance is rarely straightforward.

PCI DSS 6.4.3 requires organizations to maintain integrity controls over all JavaScript running on payment pages, while 11.6.1 requires continuous monitoring and alerting for script changes. For hospitality brands, compliance is harder than in other industries because: The result: Security teams struggle with fragmented visibility, manual evidence collection, and constant alerts during audits.

If your website or digital app collects, tracks, or sells data from Colorado residents, chances are the Colorado Privacy Act (CPA) applies to you. Like California’s CCPA and Virginia’s VCDPA, the CPA is part of the growing patchwork of state-level privacy laws reshaping how U.S. businesses handle personal data. Yet many companies underestimate the scope of the Colorado Privacy Act—or assume compliance is covered by PCI DSS or HIPAA if they process payments or healthcare data.

If you operate a website, run targeted ads, or use third-party analytics, the answer is likely yes. Since its enforcement began in 2020, the California Consumer Privacy Act (CCPA) has reshaped data privacy obligations in the U.S., granting California residents GDPR-like rights to access, delete, and opt out of data sales. But while companies scramble to update privacy policies and cookie banners, the client-side risks often go unaddressed.

If your company works with the U.S. government, manages sensitive data, or seeks to align with recognized best practices, the answer is almost certainly yes. National Institute of Standards and Technology requirements can be daunting. While many companies focus on firewalls, servers, and cloud environments, the client-side of the web application—where sensitive data is collected from customers and employees—is often left unprotected. This blind spot is a key compliance risk under NIST.