Partial Evaluation
PCIComplianceHubLast updated
An evaluation of a payment page that ran and returned results but did not see the whole page: some script bodies were unreadable, a frame could not be inspected, or requests were blocked. The distinction governs what the result can be read to mean. A partial evaluation supports the claim that the mechanism was performed in the period, because it ran and its headers are trustworthy, but not the claim that nothing changed, because its comparison covers only what it saw. Reporting the two facts separately stops a scan that read almost nothing from being recorded as a clean page.
Applies to. PCI DSS v4.0.1 does not define partial evaluation. It is a result state used in payment page evaluation reports to record that the change- and tamper-detection mechanism the standard requires on payment pages ran in the period but could not read every script body, frame or request on a page. The state matters because the standard asks both that the mechanism runs at least weekly (or at a frequency set by targeted risk analysis) and that it alerts on unauthorised change; a partial run evidences the first but not the second for the parts it did not see.
Limits. A partial evaluation is neither a failed run nor a clean page; it records that the mechanism ran, what it read and what it could not.
Related. Payment Page, Payment Page Script, Change-and-Tamper Detection Mechanism, Coverage Satisfied, Coverage Unknown
Sources. PCI DSS v4.0.1 (June 2024)