PCI DSS 4.0 · REQUIREMENT 6.3.2
Your SBOM lists 10,000 components. Your QSA wants the 37 that load in the CDE.
PCI DSS 4.0 turned Requirement 6.3.2 into a workflow, not a deliverable. Score your evidence against the 19 questions QSAs are actually asking in 2026 — and see whether you're audit-defensible or still running an SBOM-only posture.
Runtime provides truth.
Get the PCI DSS 4.0 readiness checklist
A free one-page checklist — 19 evidence checks across Requirement 6.3.2 and its neighbors. Instant download.
Thanks! Your checklist is ready:Download the checklist
Oops! Something went wrong while submitting the form.
What we validate:
Execution of recent npm, Shai-Hulud and TeamPCP-related code paths.
Credential exposure (tokens, env, CI secrets).
Persistence or follow-on activity.
Runtime reachability and exploitability.
WHAT'S INSIDE
19 evidence checks across Requirement 6.3.2 and its neighbors. Here's what's inside:
The declared inventory (6.3.2) — a per-build SBOM with provenance
The runtime layer — which components actually loaded in the CDE
Reachability, the justified backlog, and remediation on a clock
A 0–19 scoring rubric: audit-defensible, or SBOM-only
Mark only the evidence you can produce on demand today — the way a QSA will ask for it.
Get the PCI DSS 4.0 readiness checklist
Score your PCI DSS 4.0 evidence against the questions QSAs are really asking in 2026.
Thanks! Your checklist is ready:
Download the checklistOops! Something went wrong while submitting the form.