Coverage Satisfied
PCIComplianceHubLast updated
The state recorded when every actively monitored payment page was seen in full by its most recent evaluation. Deliberately separate from whether the evaluation cadence was met: cadence answers whether the mechanism ran in the period, coverage answers whether it saw everything. Collapsing the two either lets a scan in which every script body was unreadable read as fully covered, or lets one flaky asset report an otherwise complete week as unevaluated.
Applies to. PCI DSS v4.0.1 does not define coverage satisfied. It is a result state in payment page evaluation reports meaning that every payment page under active monitoring was read in full by its most recent evaluation, recorded separately from whether the weekly (or targeted-risk-analysis-defined) cadence was met. Cadence met and coverage satisfied together are what supports the claim that the change- and tamper-detection mechanism for payment pages both ran and compared whole pages.
Limits. Coverage satisfied says nothing about whether a page changed; the comparison result is reported separately.
Related. Coverage Unknown, Partial Evaluation, Payment Page, Change-and-Tamper Detection Mechanism, Script Inventory
Sources. PCI DSS v4.0.1 (June 2024)