PCI DSS 4.0 and Software Component Inventory: What Payment Teams Must Do Before March 2025

What Requirement 6.3.2 Actually Says

PCI DSS 4.0 Requirement 6.3.2 states that organizations must maintain an inventory of all bespoke and custom software and its associated third-party software components (libraries, frameworks, and other code). The inventory must be used to ensure security vulnerabilities in the included components are identified and remediated. The requirement applies to any organization that develops its own payment software — including in-house payment processors, payment application developers, and merchants with custom checkout implementations.

Who Is Affected

Requirement 6.3.2 applies to organizations that develop bespoke or custom software for use in their cardholder data environment (CDE). This includes: banks and financial institutions that develop custom payment applications; fintech companies building payment processing software; merchants who develop their own point-of-sale or e-commerce checkout systems; payment facilitators who build custom payment products; and service providers offering custom payment software to merchants. Organizations that exclusively use commercial off-the-shelf payment software (with no customization) may have a narrower application of this requirement.

The SBOM Connection

Requirement 6.3.2's mandate for a third-party component inventory is a functional SBOM requirement. The most effective way to satisfy it is to implement SCA tooling that generates and maintains a machine-readable SBOM for every custom application. The SBOM serves as the inventory, and continuous vulnerability monitoring against the SBOM satisfies the requirement to use the inventory to identify and remediate security vulnerabilities in included components.

Evidence Required for Audit

During a PCI DSS 4.0 assessment, QSAs (Qualified Security Assessors) will examine evidence of compliance with 6.3.2. Organizations should be prepared to provide: a documented process for maintaining the software component inventory; the inventory itself (an SBOM for each custom application in scope); evidence that the inventory is used for vulnerability management (vulnerability scan results linked to SBOM components); and documentation of how the inventory is kept current (typically through automated SBOM generation on each build).

Integration with Broader SBOM Compliance

Many payment technology companies are simultaneously subject to other SBOM requirements — EO 14028 if they have federal customers, EU CRA if they have EU customers, and potentially FDA requirements if they have any medical payment device products. The SBOM program built to satisfy PCI DSS 4.0 Requirement 6.3.2 provides the foundation for satisfying all of these requirements, since the underlying capability — automated component inventory — is common across all frameworks.