Baseline (Change Detection)

PCIComplianceHubLast updated

In change detection, the recorded prior state a new observation is compared against: the hashes of the scripts seen on a payment page, and the security-relevant response headers it returned. A difference from the baseline is what raises a change alert. Baselines are held field by field rather than as a single record, so an incomplete scan that failed to read part of a page cannot erase a baseline that had been measured properly. Distinct from Baseline Security, which is the general term for a minimum set of controls.

Applies to. Any 11.6.1 mechanism. A change is only detectable against something recorded earlier.
Example. First run: a Content-Security-Policy header present, three scripts with hashes A, B and C. Later run: the header gone and script B hashing differently. Two alerts, each naming the field that moved and both values.
Limits. A baseline is a record of a moment, not a judgement that the moment was safe: if the page was already compromised when the baseline was taken, the compromise is the baseline. Someone has to authorise the first state and each accepted change, or the mechanism only measures drift from an arbitrary point. 11.6.1 also names indicators of compromise as something to alert on, which a pure comparison does not do.
In PCI DSS v4.0.1. 11.6.1 (Payment page header monitoring)
Related. Change-and-Tamper Detection Mechanism, Hash Drift, Script Inventory, Baseline Security
Sources. PCI DSS v4.0.1 (June 2024)