Security awareness training for PCI DSS
PCI DSS v4.0.1 requirement 12.6 asks for a formal security awareness programme for all personnel, with training when people join and at least once every 12 months. Our courses map to PCI DSS 12.6, including phishing and social engineering (12.6.3.1) and acceptable use of end-user technology (12.6.3.2).
Key facts
| Standard | PCI DSS v4.0.1 |
|---|---|
| Who it applies to | Any organisation that stores, processes or transmits payment card data |
| Main training requirement | 12.6 security awareness programme (12.6.1 to 12.6.3.2) |
| How we describe our part | Maps to PCI DSS 12.6 |
| Our library | A new UK and US library of finished courses (50 UK, 51 US), with a PCI DSS course for people who take card payments |
The PCI DSS text sits behind the PCI Security Standards Council's licence page, so this page gives requirement numbers with our own short descriptions, no quotes.
Requirements and the course topics that cover them
The UK and US edition is a new library made for UK and US teams: 40 story courses and 12 standards courses, 52 in all, all finished. Course names here are the names in that library; they have no course pages of their own yet.
| What it asks | Our course topics |
|---|---|
|
12.6.1 A formal security awareness programme for all personnel |
The programme: every course assigned to all staff, with LMS records. Standards course: PCI DSS for People Who Take Card Payments Your own card data policy and each person's part in protecting card data: our PCI DSS course plus your policy. |
|
12.6.2 The programme is reviewed at least every 12 months and updated |
The yearly review of your programme is yours. |
|
12.6.3 Training when people join and at least every 12 months; staff acknowledge the security policy |
The programme: every course assigned to all staff, with LMS records. Standards course: PCI DSS for People Who Take Card Payments The yearly policy acknowledgement is yours. |
|
12.6.3.1 Training covers threats, including phishing and social engineering |
About it: Spotting Fake Emails; Spotting Manipulation at Work; Phone Call Scams at Work; Scam Texts and Gift Cards Also: Invoice and Refund Fraud; Defending Against Targeted Attacks; Phone Repairs and Lost Devices; Oversharing on Social Media; Tailgating and Visitor Control Standards course: Deepfakes and Voice Cloning; PCI DSS for People Who Take Card Payments |
|
12.6.3.2 Training covers acceptable use of end-user technology |
About it: Cloud Access Reviews; Work Profiles on Personal Phones Also: Fake Virus Warnings; Oversharing on Social Media; Hidden Data in Shared Files Standards course: Acceptable Use of Work Technology; Safe Use of AI Tools; Security Onboarding: Your First Week; PCI DSS for People Who Take Card Payments |
|
8.3.8 Authentication policies are communicated to all users |
About it: Storing Passwords Safely; MFA, Passkeys and Sign-In Alerts Also: Breach Notices and Stolen Data Standards course: Security Onboarding: Your First Week Your own authentication policy must also reach every user. |
|
9.5.1.3 Training for staff where card terminals are used (spotting tampering and swapped devices) |
Standards course: PCI DSS for People Who Take Card Payments Only the PCI DSS course for people who take card payments teaches terminal tampering. |
|
5.4.1 Technical protection of staff against phishing |
A technical control (email filtering), not training: yours. |
|
12.10.4 Incident response staff are trained for their role |
Role-based training: yours. |
|
6.2.2 Developers of custom software are trained |
Secure coding training: outside our library. |
When training must happen
When people join and at least once every 12 months (12.6.3), with a yearly acknowledgement of your security policy. The programme itself is reviewed at least every 12 months (12.6.2).
What an auditor asks to see
Evidence for PCI DSS
- Records of the security awareness programme: who was trained, on what, and when.
- Each person's acknowledgement of your security policy.
- Proof that the programme was reviewed in the last 12 months.
- From our LMS: who finished each course, quiz scores and certificates.
What our LMS gives you today
- Assignments: give courses to teams or people and see who finished.
- A scenario quiz after every course: 10 questions from a bank of 13 to 15, pass mark 80, a score for each learner.
- A certificate for every learner who passes.
- One space per client, and your own report method and security contact on the last screen of each course.
- The full transcript of every course on its course page, as a copy of the training material.
What stays your job
Our library is the all-staff awareness layer. These parts of PCI DSS are yours:
- The yearly policy acknowledgement (12.6.3) and the yearly programme review (12.6.2).
- Training for incident response staff (12.10.4) and developers (6.2.2).
- Technical anti-phishing protection (5.4.1).
- Your own procedure for inspecting card terminals (9.5.1.3); our PCI DSS course teaches the staff side.
Questions people ask
Which PCI DSS requirement covers security awareness training?
Requirement 12.6, with the detail in 12.6.1 to 12.6.3.2: a formal programme, a yearly review, training on hire and yearly, and the topics.
How often must staff be trained under PCI DSS?
When they join and at least once every 12 months (12.6.3).
Do your courses cover phishing and social engineering for PCI DSS 12.6.3.1?
Yes: Phishing Awareness, Social Engineering, Vishing and Smishing are about exactly that, and more courses cover parts of it.
Sources
Last updated: 2026-10-16. This page explains how our training relates to PCI DSS; it is not legal advice.