PCI DSS 6.4.3 solution for payment-page scripts
An authorized inventory of every script on a payment page, a written reason it is there, and a named person who authorized it. Last reviewed against PCI DSS v4.0.1 in September 2026.
PCI DSS v4.0.1 requirement 6.4.3 is that inventory: the list, the reason, and the name. Manifest produces that record. It is not a certificate. Tagnovo is not a QSA and does not certify compliance.
What the requirement asks for
A payment page may only load scripts that someone has authorized. For each of those scripts there must be a written justification — what it does, and why it has to run on that page — and a named person who authorized it. An inventory that a system generated and nobody attested is not the record.
What the evidence looks like
An assessor asks to be shown three things that stay together: the list of scripts that ran on pages in payment scope, the justification written against each one, and who authorized it. A change to an authorized script is a new decision, not an edit of the old one.
Which pages are in scope
The pages that collect or transmit payment-card data. On a hosted checkout that is often a small set of URL patterns the merchant declares. The SAQ type they validate under decides how far that set reaches; it is not something a scanner can infer from the storefront.SAQ A or SAQ A-EP is the question underneath this.
Related
PCI DSS 11.6.1 solution
Spotting unauthorized change, at least weekly, as the browser received the page.
How the inventory is kept
Payment-page script monitoring — including why the tag never reads form fields, and why its own hash is on the list.
What a scan cannot see
What a scanner cannot see, and why a hosted checkout needs a first-party reading.
Questions people ask
Is Tagnovo a PCI DSS 6.4.3 solution?
Manifest produces the authorized inventory, the written reason, and the named authorization a 6.4.3 assessor asks to see. Tagnovo is not a QSA and does not certify compliance.
Does a generated list satisfy PCI DSS 6.4.3?
No. An inventory that a system generated and nobody attested is not the record. A change to an authorized script is a new decision, not an edit of the old one.
See payment page script monitoring
Tagnovo is not a QSA and does not certify compliance. Manifest produces the inventory, the authorization record and the change evidence that an assessor asks to see.