[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-6":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",84,"PCI Security Standards Council","**What it asks for.** Requirement 6 of PCI DSS v4.0 covers protecting system components and software from vulnerabilities. It addresses secure development of bespoke and custom software, identifying and ranking vulnerabilities, installing security patches, protecting public facing web applications against attacks and managing changes to system components.\n\n**In practice.** Organisations train developers in secure coding, review code before release, maintain an inventory of bespoke software and third party components, apply critical patches within defined timeframes and protect public facing web applications, for example with an automated technical solution. v4.0 also expects control over payment page scripts. Evidence includes secure development procedures, code review records, patching records and change control documentation.\n\n**Common gaps.** Component inventories for custom software are often incomplete. Payment page script management, newer in v4.0, is a frequent gap for e-commerce merchants.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},447,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"critical-sap-netweaver-flaws-demand-immediate-patching-action","Critical SAP NetWeaver Flaws Demand Immediate Patching Action","2026-11-10T12:22:07.64+00:00",{"slug":24,"title":25,"published_at":26},"sap-releases-patches-for-four-cvss-100-flaws-enabling-remote-code-execution","SAP Releases Patches for Four CVSS 10.0 Flaws Enabling Remote Code Execution","2026-11-10T11:23:05.739+00:00",{"slug":28,"title":29,"published_at":30},"chromes-eighth-zero-day-of-2026-underscores-browser-patching-urgency","Chrome's Eighth Zero-Day of 2026 Underscores Browser Patching Urgency","2026-11-10T11:22:03.233+00:00",{"slug":32,"title":33,"published_at":34},"critical-barracuda-esg-flaws-exploited-for-root-access","Critical Barracuda ESG Flaws Exploited for Root Access","2026-11-10T11:21:23.607+00:00",{"slug":36,"title":37,"published_at":38},"ai-accelerates-vulnerability-discovery-in-connected-devices-manufacturers-must-act","AI Accelerates Vulnerability Discovery in Connected Devices — Manufacturers Must Act","2026-11-10T11:20:23.113+00:00",{"slug":40,"title":41,"published_at":42},"critical-unpatched-vulnerabilities-in-ibm-aspera-faspex-and-freeswitch-actively-exploited","Critical Unpatched Vulnerabilities in IBM Aspera Faspex and FreeSwitch Actively Exploited","2026-11-10T10:21:29.273+00:00",{"slug":44,"title":45,"published_at":46},"apple-patches-nine-ios-flaws-including-bluetooth-pairing-bypass-and-imessage-exposure","Apple Patches Nine iOS Flaws Including Bluetooth Pairing Bypass and iMessage Exposure","2026-11-10T09:21:46.525+00:00",{"slug":48,"title":49,"published_at":50},"wsftp-server-flaws-enable-credential-theft-and-remote-attacks-without-patching","WS_FTP Server Flaws Enable Credential Theft and Remote Attacks Without Patching","2026-11-10T09:21:04.381+00:00",{"slug":52,"title":53,"published_at":54},"chromes-eighth-zero-day-of-the-year-underscores-urgent-patch-discipline","Chrome's Eighth Zero-Day of the Year Underscores Urgent Patch Discipline","2026-11-10T09:20:46.105+00:00",{"slug":56,"title":57,"published_at":58},"chromes-eighth-zero-day-of-2026-highlights-urgent-patching-demand","Chrome's Eighth Zero-Day of 2026 Highlights Urgent Patching Demand","2026-11-10T08:22:01.8+00:00",{"slug":60,"title":61,"published_at":62},"chrome-xml-zero-day-exploited-in-the-wild-eighth-this-year","Chrome XML Zero-Day Exploited in the Wild — Eighth This Year","2026-11-10T07:20:48.606+00:00",{"slug":64,"title":65,"published_at":66},"actively-exploited-flaws-in-openssh-gpustack-ibm-demand-immediate-patching","Actively Exploited Flaws in OpenSSH, GPUStack & IBM Demand Immediate Patching","2026-11-10T07:20:24.48+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",361,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",338,{"slug":79,"name":80,"problem":81,"stories":82},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",126,{"slug":84,"name":85,"problem":86,"stories":87},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",113,{"slug":89,"name":90,"problem":91,"stories":92},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",38,{"slug":94,"name":95,"problem":96,"stories":97},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",28,[99,105,111,117,123,129,135,140],{"family":100,"item":101,"code":102,"title":103,"together":104},"nist-800-53","si-2","SI-2","Flaw Remediation",414,{"family":106,"item":107,"code":108,"title":109,"together":110},"cis","7","Control 7","Continuous Vulnerability Management",411,{"family":112,"item":113,"code":114,"title":115,"together":116},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",368,{"family":118,"item":119,"code":120,"title":121,"together":122},"owasp","top10-2021-a06","A06:2021","A06:2021 Vulnerable and Outdated Components",351,{"family":124,"item":125,"code":126,"title":127,"together":128},"nis2","21-2-b","Article 21(2)(b)","Incident handling (Article 21(2)(b))",333,{"family":130,"item":131,"code":132,"title":133,"together":134},"nist-csf","pr-aa","PR.AA-01","PR.AA: Identity Management, Authentication, and Access Control",311,{"family":106,"item":136,"code":137,"title":138,"together":139},"17","Control 17","Incident Response Management",59,{"family":141,"item":142,"code":143,"title":144,"together":145},"gdpr","32","Article 32","Security of processing",55]