Runtime Application Self-Protection (RASP)
PCIComplianceHubLast updated
A security technology that monitors application execution and detects and prevents real-time attacks by analyzing application behavior. Implementing RASP can help organizations strengthen the security of their cardholder data environment and support PCI DSS compliance efforts.
Applies to. PCI DSS v4.0.1 does not name RASP. The nearest requirement is 6.4.2, which requires an automated technical solution for public-facing web applications that continually detects and prevents web-based attacks; a RASP agent is sometimes offered as a way to provide that. 6.4.2 says the solution is installed in front of the application, and its guidance names a web application firewall as the example, so an entity relying on an in-process agent alone should expect to show the assessor how it meets that wording rather than assume it does.
Related. Web Application Firewall (WAF), Web Application, Application Security, Injection Attack, Secure Coding
Sources. PCI DSS v4.0.1 (June 2024)