Hash Drift

Applies to. It applies to any entity with payment pages in scope for 11.6.1, which requires a change- and tamper-detection mechanism to evaluate the script contents of those pages as received by the consumer browser, at least weekly or at a frequency set by the entity's targeted risk analysis under 12.3.1, and to alert personnel when they change. 11.6.1 also names indicators of compromise, additions and deletions, so drift is one of several finding types the mechanism has to report, alongside changes to security-impacting HTTP headers.

Example. An online retailer's checkout loads a fraud-scoring script from a third-party address, and the weekly evaluation shows the script's hash no longer matches its baseline although the address is unchanged. The team confirms with the provider that a new version shipped the day before, reviews what the new contents do, and records the new hash as the baseline. Had the provider known nothing about a change, the same finding would have been handled as a possible compromise.

Limits. Hash drift is a site term, not a Council one, and it names one kind of finding rather than a control. It says the bytes changed; it does not say whether the change was authorised, and 11.6.1 asks the mechanism to alert personnel, leaving the verdict to them. It does not cover a new script appearing, a script vanishing or a security-impacting HTTP header changing, all of which 11.6.1 also requires the mechanism to report. And it is a browser-side observation: a hash comparison on the web server's own files is file integrity monitoring under 11.5.2, which cannot see what a consumer's browser actually received.