Topic starter
19/08/2026 3:31 pm
TL;DR: Marriott Vacations Worldwide says it achieved full compliance with PCI DSS v4 requirements 6.4.3 and 11.6.1 by using Jscrambler’s Webpage Integrity to control third-party scripts, improve visibility across payment pages, and reduce manual oversight in a complex browser environment, according to Jscrambler. The governance lesson is that client-side risk now sits squarely inside broader identity, access, and data control programmes, not just web security.
Editorial analysis by NHI Mgmt Group, based on content published by Jscrambler: “Need: Compliance Enforcement”.
Key questions
Q: Where does browser-side payment control fail in practice?
A: It fails when teams focus on the payment form but ignore the scripts and tags that execute around it.
Q: Why do third-party scripts complicate PCI DSS compliance so much?
A: Third-party scripts complicate compliance because they extend trust outside the merchant’s direct codebase and can change without the merchant’s release process.
Q: What signals show that client-side compliance is drifting?
A: Common signals include uncatalogued payment pages, frequent script changes, inconsistent header integrity, and reliance on manual reviews to explain what is running in production.
Practitioner guidance
- Inventory every web-based payment page Build and maintain a complete list of pages that accept card data, including pages added by marketing or business teams outside core IT.
- Govern third-party script approvals Require explicit review for every script or tag that can execute on payment pages, with a named business justification and security owner.
- Monitor browser-side integrity continuously Use runtime monitoring for headers and script behaviour so drift is detected after deployment, not only during periodic audits.
Bottom line: Browser-side payment security now depends on controlling third-party execution, not just hardening the server-side stack.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:14 pm
Browser-side integrity is now a governance problem, not only a web security problem. When third-party scripts can alter payment-page behaviour, the control boundary extends into browser execution and page ownership. That means compliance teams, web teams, and identity governance teams all have a stake in approval, inventory, and monitoring. Practitioners should treat payment-page integrity as part of broader control assurance, not a narrow front-end control.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: Which PCI DSS v4 controls are most relevant to browser-side script governance?
A: The controls most directly tied to browser-side script governance are the ones covering script integrity and change detection on payment pages. Practitioners should map their web execution controls to the PCI requirements that drive continuous monitoring, evidence collection, and approval discipline across the browser environment.
👉 Read our full editorial: Browser-side payment page integrity raises the bar for PCI control