EvidenceSheet
PCI DSS v4.0.1 · Req 6: Secure Systems and Software

6.3.3 Timely installation of security patches

All system components must be shielded from known vulnerabilities by applying relevant security patches or updates such that: patches or updates addressing critical vulnerabilities, as ranked under Requirement 6.3.1, must go in within one month of their release; and every other relevant security patch or update is installed within a suitable time frame set by the entity's own assessment of how critical the risk is to its environment, using the Requirement 6.3.1 ranking process. It applies to all entities and all system components. Customized approach objective: exploitation of a known vulnerability cannot be used to compromise system components.

Source: PCI DSS v4.0.1, 6.3.3. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.

5
artefacts
1
held by a system
2
at each review
hard
to go live
Vulnerability scanner / patch tooling
where the evidence lives
teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

  • Patch compliance reports per system component showing install dates against vendor release dates · Vulnerability scanner / patch tooling

periodic reviewEvidence produced at each review

  • Risk-based rationale or targeted risk analysis for non-critical patch time frames · Vulnerability scanner / patch tooling
  • Sample of critical advisories traced to installation evidence · Vulnerability scanner / patch tooling

governing documentDocuments that govern the control

  • Patch management procedure stating the one-month deadline for critical patches and time frames for others · Policy repository / GRC workspace
  • Exception register for patches that could not be applied, with compensating measures · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Vulnerability scanner / patch tooling on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

6.3.2 Inventory of bespoke software and components · 6.4.1 Public web application review or automated protection