What it asks for. Requirement 6 of PCI DSS v4.0 covers protecting system components and software from vulnerabilities. It addresses secure development of bespoke and custom software, identifying and ranking vulnerabilities, installing security patches, protecting public facing web applications against attacks and managing changes to system components.
In practice. Organisations train developers in secure coding, review code before release, maintain an inventory of bespoke software and third party components, apply critical patches within defined timeframes and protect public facing web applications, for example with an automated technical solution. v4.0 also expects control over payment page scripts. Evidence includes secure development procedures, code review records, patching records and change control documentation.
Common gaps. Component inventories for custom software are often incomplete. Payment page script management, newer in v4.0, is a frequent gap for e-commerce merchants.