Free guide · PCI DSS v4.0.1

PCI DSS Requirement 6.3.3 — Patching known vulnerabilities

Requirement 6.3.3 protects all system components from known vulnerabilities through patching. Patches for critical vulnerabilities, ranked using the process in Requirement 6.3.1, must be installed within one month of release; everything else within a timeframe the entity justifies from its own risk ranking.Timing: Applies in PCI DSS v4.0.1 and is assessed at every annual assessment.

Find your SAQ All guides

Who it applies to

Every in-scope system component, including software the entity did not write

Entities completing SAQ C, SAQ D-Merchant or SAQ D for Service Providers

What Requirement 6.3.3 asks for

Paraphrased from PCI DSS v4.0.1. Read the standard itself for the authoritative wording and testing procedures.

All system components are protected from known vulnerabilities by installing applicable security patches and updates.

Patches for critical vulnerabilities are installed within one month of release.

All other applicable security patches are installed within a timeframe the entity determines from its risk ranking.

Criticality is decided by the risk ranking process established in Requirement 6.3.1.

Evidence an assessor expects

The documented vulnerability risk-ranking process from Requirement 6.3.1

Patch deployment records with release date and install date for critical patches

An inventory reconciling patched hosts against the full in-scope asset list

Exception records with compensating controls for anything not patched in time

Common mistakes

Measuring the one-month clock from ticket creation instead of vendor release date.

Patching operating systems but not firmware, libraries, plugins or container base images.

No risk-ranking process at all, which makes the 'critical' classification unevidenced.

Not sure whether Requirement 6.3.3 is in your scope?

Which requirements you must answer depends on the SAQ that applies to your environment. The free SAQ selector walks the official PCI SSC decision flow, records every answer and re-derives the recommendation server-side with a confidence score.

Run the SAQ selector Talk to a QSA

Paraphrased from PCI DSS v4.0.1 (PCI Security Standards Council). Independent summary; not endorsed by PCI SSC. Refer to the PCI SSC Document Library for the authoritative standard.