The assessment workspace for QSA firms

Enpasse drafts, suggests and cites from your evidence. Your assessors make every call.

Apply for early access See how it works

Private preview. Generally available December 2026.

Back to Testing

6.3.16.3.26.3.36.4.16.4.26.4.36.5.16.5.26.5.36.5.46.5.56.5.6 Requirement 6

6.4.3

Payment page scripts authorized, checked and justified

0 of 2

Every payment page script authorized, checked and justified. New in v4.

Testing procedures

6.4.3.bExamine records

Suggested

Examine the script inventory and the payment page configuration.

Files

EV-061 v2 lines 3 to 29 EV-062 v1 region EV-063 v1 p. 2

Result

Found

AcceptedMR14:32

3 of 14 files usedAll accounted for

Sources14Gaps0History

Suggested3

EV-061 v2

Payment page script inventory

22{ "src": "chat-widget.example.net/loader.js",

23 "justification": "",

24 "integrity": "none" }

EditNot relevantAccept

EV-062 v1

Checkout page headers

Content-Security-Policy: script-src 'self' pay.example.net

EV-063 v1

Script approval procedure

Accept 6.4.3.b

jNextkPreviousoOpen the passagenNext needing me

Maria Reyes accepted 6.4.3.bFailing

Maria Reyes

Synthetic data, illustrative, pending QSA reviewNorthwind Retail, ROC 2026

Built for the assessor's side of PCI DSS. Every result needs a reason and a name.

Files, interviews, scans, client replies and scope answers all go into one record: the ROC for Northwind Retail 2026, 291 pages.

Parts into the record

Every file, interview, scan and reply lands in one decided ROC.

A QSA's week

Less copying.
More deciding.

Same assessment, same assessor, kickoff to delivery.

Kickoff~~Retyped from last year~~Entered once
Files~~Renamed by hand~~Placed and cited
Scoping~~Every reason by hand~~Reasons drafted
Testing~~Written twice~~Accepted once
Requests~~A long email~~One text, your email
End of Assess~~“I think we’re done”~~Nine gates met
Write~~Days in the template~~A cited draft
QA~~A full reread~~Only what changed
Client review~~Margin comments~~One request per page
Months later~~Rebuilt from email~~History answers

One assessment

Eight months.
One scroll.

All 260 sub-requirements of one ROC. Every result ends with a person's name.

Scope
Evidence
Assess
Write
QA review
Client review
Export

Sub-requirements0 of 260 decided

Point at a sub-requirement

Files: 0
Suggestions waiting: 0
Report pages: 0
Client requests: 0 of 8

History

1Evidence

Every file in its place,
cited to the line

Your team adds what the client sends. Enpasse reads each file and maps it to the sub-requirements it supports.

Evidence

Upload evidence

FilesWalkthrough recordsGraph

Requests180

Needs you5

Mapped14

Tested314

Set aside79

Files412

FileLinked toAdded byAddedStatus

EV-413 v1Payment page script inventory6.4.311.6.1SOTodayMapped

EV-414 v1CDE network diagram, version 61.2.31.4.1SOTodayMapped

EV-415 v1Anti-malware console export, October5.2.25.3.2SOTodayMapped

EV-416 v1ASV scan report, Q3, Harbor Scan Services11.3.2SOTodayMapped

EV-005 v4Cardholder data flow diagram1.2.412.5.2MR15 OctTested

EV-112 v1Interview record, SOC lead10.4.110.4.1.110.7.21 moreMR15 OctTested

EV-142 v1Point-of-sale server configuration, POS-04 and POS-052.2.12.2.42.2.5SO15 OctMapped

EV-170 v1Observation record, store media storage9.4.19.4.2AL15 OctTested

EV-232 v1Observation record, change, patching and anti-malware6.3.35.2.26.5.11 moreSO15 OctTested

EV-110 v1Interview record, incident response lead12.10.1MR14 OctMapped

EV-111 v1Interview record, access administrator7.2.17.2.2AL14 OctMapped

EV-120 v1Firewall rule review, April to September1.2.71.3.1MR14 OctMapped

EV-130 v1Targeted risk analysis register12.3.15.2.3.1SO13 OctTested

Upload files

4 files

Drop files or a folderor choose them; up to 2 GB a file

checkout-script-inventory.json0.2 MB

ConfigurationMapped6.4.311.6.1

cde-network-diagram-v6.png1.8 MB

ScreenshotMapped1.2.31.4.1

antimalware-console-2026-10.csv0.9 MB

SpreadsheetMapped5.2.25.3.2

asv-scan-2026-q3.pdf3.4 MB

Scan reportMapped11.3.2

L. Chen, 24 OctDone

Sam Ortiz

Features

2Assess

Accept the result,
and the testing is written

Enpasse suggests a result with its sources. Your assessor accepts, changes or rejects it.

A cited draft,
not a blank template

Enpasse drafts the Report on Compliance (ROC) in the template's order. Every sentence cited, waiting for your lead.

Develop and maintain secure systems and software

6.4.2Automated detection of attacks on public web appsAccepted

6.4.2Examine the system configuration settings of the automated solution.

Reporting details: assessor's response

The assessor examined the web application firewall policy in front of checkout EV-058 v1 and its alert routing to the on-call analyst EV-059 v2. The policy blocks and logs attacks and is updated weekly EV-058 v1.

6.4.3Payment page scripts authorized, checked and justifiedSuggested

6.4.3.bExamine the script inventory and the payment page configuration.

Reporting details: assessor's response

6.5.1Changes to systems follow a documented processNeeds review

6.5.1.bExamine recent changes and trace them to their change records.

Reporting details: assessor's response

The assessor sampled 25 changes from the change log EV-071 v1. Each had an approval, a test record and a back-out plan EV-072 v1.

6.4.3.bReporting details Drafting

Describe how the inventory and configuration show each script is authorized, checked and justified.

Suggestedfrom 2 accepted results

MRMaria Reyes1 sentence changed14:41

LengthStandardTechnical depthStandard3 files cited

EV-061 v2Payment page script inventory

checkout-script-inventory.jsonAdded by Sam Ortiz, 9 Oct

22{ "src": "chat-widget.example.net/loader.js",

23 "justification": "",

24 "integrity": "none" },

25{ "src": "cdn.example.org/test-loader.js", ...

Lines 22 to 29Open the file

MRMaria Reyes Suggest againAccept

291pages drafted the day Assess was signed off

Northwind Retail, synthetic

Features

4Export

Hear every request.
Decide every change.

Your lead decides each client request, then finalizes the ROC and the Attestation of Compliance (AOC).

Report on Compliance

Version 3, agreed

Northwind RetailLevel 1 merchantPCI DSS v4.0.13 Feb to 24 Oct 2026

Version 3 agreedL. Chen, 9 Nov

Part 1Assessment overview6 of 6 approved

1Contact information and summary of resultsMRApproved

2Business overviewSOApproved

3Scope of work and approach takenMRApproved

4Details about reviewed environmentsSOApproved

5Quarterly scan resultsSOApproved

6Sampling and evidenceMRApproved

Part 2Findings and observations264 of 264 decided

1Install and maintain network security controls19 of 19 decided

2Apply secure configurations11 of 11 decided

3Protect stored account data29 of 29 decided

4Protect cardholder data in transmission6 of 6 decided

5Protect systems from malicious software13 of 13 decided

6Develop and maintain secure systems32 of 32 decided

7Restrict access by business need to know9 of 9 decided

8Identify users and authenticate access41 of 41 decided

9Restrict physical access to cardholder data30 of 30 decided

10Log and monitor all access31 of 31 decided

11Test security of systems and networks21 of 21 decided

12Support security with policies and programs22 of 22 decided

Attestation of Compliance3 parts

1Contact informationPrepared

2Executive summaryPrepared

3Validation and attestationDate of report 9 Nov

In Place226Not Applicable38Not in Place0

Finalize ROC and AOC Checking

Northwind RetailVersion 3Meridian Assurance

0 of 7

Final filesMR16 Nov, 10:02

ROC, Word············

ROC, PDF············

AOC, PDF············

MRMaria ReyesLead QSA CancelFinalize ROC and AOC DownloadRecord delivery

Features

One file

One file,
kickoff to AOC

The same citation travels through every stage. Nothing is copied by hand.

AI use

With AI
or without it

Your lead picks the mode per assessment. Every step works with no AI at all.

TestingNorthwind Retail

1.2.7Network security controls reviewed every six months In PlaceMR

6.4.3Payment page scripts authorized, checked and justified Not in PlaceEV-061Enter result

8.3.6Passwords at least 12 characters with letters and numbers In PlaceSO

10.4.1Audit logs reviewed at least once daily In PlaceEV-088Enter result

11.3.2External scans once every three months In PlaceEV-102Enter result

12.10.1An incident response plan is ready to use In PlaceEV-131Enter result

A1.1.1Logical separation between customer environments Not ApplicableEV-004Enter result

5 suggestions waiting for a personModel calls on

Already use Claude or ChatGPT? Connect it to one assessment. Integrations

Security

What the AI
does not do

Designed to align with the PCI SSC guidance on AI in assessments.

Read about security

No file trains a modelClient evidence is never used for training.
Files stay in your firm's workspace. With AI off, no model reads them at all.
Every suggestion cites its lineSources, never a confidence number.
A suggestion opens the passage it rests on, such as EV-061 lines 22 to 24. The AI never scores itself.
A named assessor decidesThe AI never decides a result.
The server refuses a result, acceptance or stage change without a signed-in person behind it. History keeps who decided, and when.

Built for assessors.
Open for early access.

Apply for early access Read about security

The assessment workspace for QSA firms

Parts into the record

Less copying.More deciding.

Eight months.One scroll.

Every file in its place,cited to the line

Accept the result,and the testing is written

A cited draft,not a blank template

Hear every request.Decide every change.

One file,kickoff to AOC

With AIor without it

What the AIdoes not do

Built for assessors.Open for early access.

Less copying.
More deciding.

Eight months.
One scroll.

Every file in its place,
cited to the line

Accept the result,
and the testing is written

A cited draft,
not a blank template

Hear every request.
Decide every change.

One file,
kickoff to AOC

With AI
or without it

What the AI
does not do

Built for assessors.
Open for early access.