Blog

VikingCloud approves cside for PCI DSS requirement 6.4.3 and 11.6.1

cside has partnered with VikingCloud to perform a deep technical assessment of the security solutions we offer under the enterprise plan, within the scope of PCI compliance. With proper implementation, our products meet requirements 6.4.3 and 11.6.1.

Apr 24, 2025 • 2 min read

Simon Wijckmans Founder & CEO

cside-vikingcloud-partnership-cover-image

Table of Contents

TL;DR: VikingCloud QSA validation for PCI DSS 4.0.1 script control

Marketing vs assessment: Most PCI vendors publish a whitepaper they wrote themselves and call it validation. That is marketing, not assessment. A real QSA sign-off comes from a firm that audits your solution against the standard and puts its name on the finding.
VikingCloud's finding: VikingCloud, the largest global PCI compliance and security firm and Mastercard partner, ran a deep technical assessment of the cside enterprise platform. Their conclusion: the cside runtime script observability and agentless solution detected script changes via hashed values and blocking configurations, and demonstrated capability to meet PCI DSS 6.4.3 and 11.6.1 when deployed correctly.
What to ask vendors: If you are shortlisting client-side PCI tools, ask each vendor for a QSA firm's signed technical evaluation, not a self-published whitepaper. If VikingCloud's finding on cside is what you need, the detailed report is on the cside trust portal.

Short on time? See cside PCI Shield. It covers everything below in one deployment.

VikingCloud (formerly Sysnet) is the largest global PCI compliance and security firm. VikingCloud has partnerships with Mastercard and is the Qualified Security Assessor to some of the largest multinationals worldwide.

cside has partnered with VikingCloud to perform a deep technical assessment of our enterprise security solution and the scope of PCI compliance. With proper implementation, our product meets requirements 6.4.3 and 11.6.1.

VikingCloud: "During its analysis, VikingCloud confirmed that the cside Proxy and agentless solution detected the changes of the website scripts, using hashed values and/or "Blocking" configurations for specific website scripts, and demonstrated the capability to meet PCI DSS requirements 6.4.3 and 11.6.1. The technical evaluation and testing supported the finding that the solution meets the above requirements when deployed correctly. VikingCloud concluded that the solution offers protection against unauthorized script execution and prevents unauthorized changes to web-facing applications. The integration of cside platform may enable organizations to fulfill specific PCI DSS requirements and add an additional security layer for web applications."

Download the detailed report on our trust portal.

Founder & CEO Simon Wijckmans

Founder and CEO of cside. Previously a product manager on Cloudflare Page Shield (now Cloudflare Client-Side Security). Co-chair of the W3C Anti-Fraud Community Group and a Forbes 30 Under 30 honoree. Building accessible security against client-side attacks, web security is not an enterprise-only problem.

Don't just take our word for it, ask AI

Monitor and Secure Your Third-Party Scripts

Gain full visibility and control over every script delivered to your users to enhance site security and performance.

Book a demo

Start for free

Start free, or try Business with a 14-day trial.

cside dashboard interface showing script monitoring and security analytics

What Is a Business Associate Agreement (BAA)? HIPAA BAAs Explained

A Business Associate Agreement (BAA) is a HIPAA-required contract between a covered entity and a vendor that handles protected health information on its behalf, binding the vendor to safeguard that data. This guide explains what a BAA covers, who needs one, and why some website vendors refuse to sign.

What Is an Approved Scanning Vendor (ASV)? PCI ASV Scans Explained

An Approved Scanning Vendor (ASV) is a company certified by the PCI Security Standards Council to run the external vulnerability scans that PCI DSS requirement 11.3.2 mandates every quarter. This guide explains what an ASV scan covers, how it differs from internal scans and penetration tests, and what it cannot see.

What Is Cardholder Data (CHD)? PCI Definitions, CDE, and SAD Explained

Cardholder data (CHD) is the payment card information PCI DSS exists to protect: the primary account number alone or with the cardholder's name, expiration date, or service code. This guide defines CHD, sensitive authentication data (SAD), and the cardholder data environment (CDE), and explains what each means for scope.

What Is Customer Journey Hijacking? How Injected Scripts Steal Shoppers

Customer journey hijacking is the manipulation of a visitor's session by unauthorized code (injected ads, forced redirects, swapped affiliate tags) that diverts them away from the intended purchase path. This guide explains how it happens, what it costs, and how to see it on your own site.

What Is DOM-Based XSS? How DOM Cross-Site Scripting Works

DOM-based XSS is a cross-site scripting attack where the vulnerability lives entirely in client-side JavaScript: the page's own code reads attacker-controlled input and writes it into the DOM unsafely. This guide explains how it differs from reflected and stored XSS, common sources and sinks, and how to detect it.

What Is ePHI? Electronic Protected Health Information Under HIPAA Explained

ePHI is electronic protected health information: any individually identifiable health data that is created, stored, or transmitted electronically, and that HIPAA requires covered entities and business associates to safeguard. This guide defines ePHI, distinguishes it from PHI and de-identified data, and lists the 18 HIPAA identifiers.

What Is JavaScript Injection? Script Injection Attacks Explained

JavaScript injection is the insertion of attacker-controlled script into a web page so it executes in visitors' browsers with the page's full privileges. This guide covers the injection paths (XSS, compromised third parties, extensions), what injected scripts actually do, and how to detect them.

PCI DSS Report on Compliance (RoC): What It Is and When You Need One

A PCI DSS Report on Compliance is required for Level 1 merchants and service providers. Learn what a RoC covers, who signs it, and how to prepare.

What Is PII Harvesting? How Scripts Collect Personal Data at Scale

PII harvesting is the systematic collection of personally identifiable information from websites and forms, usually by scripts that read what users type, sometimes criminal, sometimes an over-collecting vendor tag. This guide explains the techniques, the difference from PII itself, and how to see harvesting on your own pages.

What Is RASP? Runtime Application Self-Protection Defined

RASP (Runtime Application Self-Protection) is a security technology that runs inside an application and blocks attacks from within at runtime, using the application's own context. This guide defines RASP, compares it to WAFs, and explains where its server-side model stops, and what plays the equivalent role in the browser.