The short answer
PCI compliance training is the formal security awareness programme that PCI DSS v4.0.1 Requirement 12.6 requires. All personnel are trained on hire and at least once every 12 months, the training covers phishing and social engineering, and staff acknowledge the security policy every year. Developers, card terminal staff and incident responders also need role-specific training under other requirements.
On this page
- Is PCI DSS training mandatory?
- What PCI compliance training does Requirement 12.6 ask for?
- How often is PCI awareness training required?
- What role-based training does PCI DSS require?
- Which PCI DSS courses and qualifications exist?
- How do you judge a PCI DSS training course?
- Is free PCI training enough?
- What evidence will a QSA ask for?
- Why Sovereign Secure
- Check your training evidence before your assessment
PCI DSS training is the security awareness programme that Requirement 12.6 of PCI DSS v4.0.1 requires for everyone who can affect the security of card data. Staff must be trained when they join and at least once every 12 months, the training must cover phishing and social engineering, and each person must acknowledge the security policy every year. Developers, staff who use card terminals and incident responders need extra, role-specific training under other requirements.
PCI DSS does not name a course, a provider or a certificate. It sets what the programme must achieve and what you must be able to prove. This guide is written from the assessor’s side of the table: what the requirements say, who they apply to, and the evidence a Qualified Security Assessor (QSA) checks.
Is PCI DSS training mandatory?
Yes, wherever Requirement 12.6 is in scope. A full assessment documented in a Report on Compliance (ROC) and SAQ D include all of Requirement 12.6. Shorter Self-Assessment Questionnaires include fewer of the Requirement 12 items, so check the questionnaire you complete rather than assuming; our free PCI compliance check suggests which one is likely to apply. Some role-based training sits in other requirements, such as Requirement 9 for staff who handle card terminals, and applies wherever those requirements are in scope.
“Personnel” is broader than employees. PCI DSS defines it to include full-time and part-time employees, temporary staff, contractors and consultants whose work touches the security of account data. In practice that usually means shop floor and contact centre staff, IT and cloud administrators, developers, finance teams handling refunds and chargebacks, managers who approve access, and the third-party contractors who support any of them.
What PCI compliance training does Requirement 12.6 ask for?
Requirement 12.6 sets out PCI DSS security awareness training in five parts. Three were new in v4.0 and became mandatory on 31 March 2025, when all the future-dated requirements took effect.
| Requirement | What it requires | Status |
|---|---|---|
| 12.6.1 | A formal security awareness programme that makes all personnel aware of the security policy and procedures, and of their role in protecting cardholder data | Carried forward from v3.2.1 |
| 12.6.2 | The programme is reviewed at least once every 12 months and updated for new threats and vulnerabilities that could affect the cardholder data environment (CDE) | New in v4.0, mandatory since 31 March 2025 |
| 12.6.3 | Training on hire and at least once every 12 months, using multiple methods of communication, with personnel acknowledging at least once every 12 months that they have read and understood the security policy and procedures | Carried forward from v3.2.1 |
| 12.6.3.1 | Training covers threats and vulnerabilities that could affect the CDE, including phishing and related attacks, and social engineering | New in v4.0, mandatory since 31 March 2025 |
| 12.6.3.2 | Training covers acceptable use of end-user technologies, in line with the policies required by Requirement 12.2.1 | New in v4.0, mandatory since 31 March 2025 |
Two details catch people out. The acknowledgement in 12.6.3 is of your security policy and procedures, so a generic vendor quiz on its own does not meet it. And “multiple methods of communication” means more than one channel, for example an online module plus team briefings, posters or short email reminders. The requirement text and testing procedures are in the standard, free from the PCI SSC document library, and our guide to Requirement 12 of PCI DSS puts 12.6 in the context of the other policy requirements.
How often is PCI awareness training required?
On hire and at least once every 12 months for everyone in scope, with a fresh policy acknowledgement each year. The other cycles in and around the programme are:
- Programme review: at least every 12 months (12.6.2).
- Developer training: at least every 12 months (6.2.2).
- Incident response training: periodically, at a frequency you set through a targeted risk analysis (12.10.4 and 12.10.4.1).
PCI DSS does not put a number of days on “on hire”. Set a deadline in your policy, ideally before a new starter is given access to card data or the CDE, and make sure your records show it was met. Many organisations add short refreshers through the year, which helps people remember the material, but the 12-month cycle is the minimum the assessor tests.
What role-based training does PCI DSS require?
Requirement 12.6 covers everyone. Three other requirements add training for particular roles:
| Role | Requirement | What the training must cover | How often |
|---|---|---|---|
| Developers of bespoke and custom software | 6.2.2 | Software security relevant to their job and languages, secure design and secure coding techniques, and how to use any security testing tools they use | At least every 12 months |
| Staff in card terminal (point-of-interaction) environments | 9.5.1.3 | Verifying the identity of anyone claiming to be a repair or maintenance engineer, never installing, replacing or returning devices without verification, spotting suspicious behaviour around devices, and reporting tampering | Not set by PCI DSS; usually built into the annual programme |
| Incident response team | 12.10.4 and 12.10.4.1 | Their responsibilities in responding to suspected and confirmed security incidents | Periodically, at a frequency set by targeted risk analysis |
| All personnel | 12.6.3, 12.6.3.1 and 12.6.3.2 | Security policy and procedures, phishing, social engineering and acceptable use of end-user technologies | On hire and at least every 12 months |
Training is only half of the phishing picture. Requirement 5.4.1 separately requires processes and automated mechanisms to detect and protect personnel against phishing attacks, such as email filtering and anti-spoofing controls. PCI DSS does not require phishing simulations, but a phishing simulation is a practical way to find out whether the training in 12.6.3.1 has changed behaviour, and the results can feed your annual review under 12.6.2.
Which PCI DSS courses and qualifications exist?
The PCI Security Standards Council runs two kinds of programme: awareness courses, which teach but award no qualification, and individual qualifications, which have eligibility rules and exams. These are the ones most relevant to PCI DSS:
| Programme | What it is | Who it is for | Keeping it current |
|---|---|---|---|
| PCI Awareness Training | A self-paced eLearning course of about four hours on how the PCI standards protect card data; no exam or certification | Executives, managers and staff affected by PCI compliance; no prior PCI knowledge needed | Not applicable |
| Working From Home: Security Awareness Training | A self-paced eLearning course of about 45 minutes on threats to payment data in remote working; no exam or qualification | Staff who handle payment account data at home or remotely | Not applicable |
| PCI Professional (PCIP) | A qualification demonstrating knowledge of payment security and the PCI standards; it does not make the holder an assessor | Any individual; the PCI SSC describes it as an entry-level qualification that is not affected by changes of employer | Three-year credential: 10 continuing professional education (CPE) hours a year, then requalification every three years |
| Internal Security Assessor (ISA) | A qualification for carrying out internal PCI DSS assessments for the sponsoring company and working with its QSA | Employees sponsored by their employer, such as a retailer, acquiring bank or processor | Re-certification every 12 months |
| Qualified Security Assessor (QSA) | A qualification for independent PCI DSS assessments, including Reports on Compliance | Only employees of a PCI SSC-approved QSA company | Requalification rules set by the PCI SSC for both the individual and the QSA company |
A PCI SSC awareness course can form part of your Requirement 12.6 programme, but it does not replace it: 12.6.3 still needs training and an acknowledgement of your own security policy and procedures.
Can I get PCI certified as an individual?
Not with a general “PCI certificate”. The PCIP, ISA and QSA qualifications above each have their own eligibility rules, and none of them is the same as an organisation being PCI DSS compliant.
These details come from the PCI SSC’s programme pages as checked on 13 October 2026, including its PCI Awareness Training page and its PCI Professional qualification page; check them there before you book anything, because eligibility, prerequisites and fees change. Commercial courses that award their own “PCI certification” are not PCI SSC qualifications. Our PCI QSA page explains what a QSA does, and our guide to PCI DSS certification explains why organisations do not receive a certificate either.
How do you judge a PCI DSS training course?
Judge it against the requirements and the evidence you will need, not the badge on the course. A suitable course or platform:
- Is current for PCI DSS v4.0.1, with explicit content on phishing, social engineering and acceptable use (12.6.3.1 and 12.6.3.2), not a v3.2.1 course with a new cover.
- Fits how you take payments. Contact centre, e-commerce and face-to-face staff face different risks, and generic content misses them.
- Points to your own policy and procedures, and records each person’s acknowledgement of the current version.
- Supports role-based modules, or lets you add your own for developers, terminal users and incident responders.
- Uses more than one format, so you can show multiple methods of communication.
- Produces exportable records: name, role, start date, module, version, completion date and acknowledgement.
- Can be updated after your annual review, so new threats you identify under 12.6.2 reach staff.
- Tracks completion against deadlines, flagging new starters and anyone approaching their 12-month date before they become an assessment finding.
For how to build an awareness programme that changes behaviour beyond the PCI minimum, see our guide on how to build a security awareness programme.
Is free PCI training enough?
It can be, because PCI DSS does not require a paid course. What it requires is content that covers your own policy, phishing, social engineering and acceptable use, delivered in more than one way, with records to prove it.
| Aspect | Free training | Paid PCI course or platform |
|---|---|---|
| Example | The NCSC’s Top Tips for Staff e-learning, plus your own briefings | Commercial PCI awareness courses and training platforms |
| What it usually covers | General awareness: phishing, passwords, securing devices and reporting incidents | Card data handling, PCI DSS context and, often, role-based modules |
| What you still add | A short module on how your organisation handles card payments, your policy acknowledgement and your own records | Your own policy and procedures, and the acknowledgement 12.6.3 requires |
| Records | You keep them yourself | Usually built in, which makes the 12-month cycle easier to evidence |
Either route can pass an assessment. The deciding questions are whether the content reflects how your staff actually take payments and whether your records will stand up when the assessor samples them.
What evidence will a QSA ask for?
The assessor examines documents and records, and interviews staff to check they understand their role. Have this ready:
| Requirement | Evidence the assessor usually asks for |
|---|---|
| 12.6.1 | The written awareness programme: audiences, content, delivery methods, owner |
| 12.6.2 | A record of the last annual review and what changed as a result |
| 12.6.3 | Training records matched against start dates and the 12-month cycle, examples of each communication method, and dated policy acknowledgements |
| 12.6.3.1 and 12.6.3.2 | Course content or slides showing phishing, social engineering and acceptable-use topics |
| 6.2.2 | Developer training records and the content covered |
| 9.5.1.3 | Training material and records for staff in card terminal environments |
| 12.10.4 and 12.10.4.1 | Incident response training records and the targeted risk analysis that sets their frequency |
Typical gaps are practical rather than technical: new starters trained weeks after they were given access, contractors left out of the training system, acknowledgements of an out-of-date policy, phishing content missing from an older course, and records split across systems that nobody can reconcile on the day.
Why Sovereign Secure
Sovereign Secure Ltd is a UK company (Companies House 08334453), founded in 2012 and headquartered in Accrington, Lancashire. The PCI Security Standards Council has approved us as a Qualified Security Assessor (QSA) company, a Qualified PIN Assessor (QPA) and a Card Production Security Assessor (CPSA), and we are a member of its Global Executive Assessor Roundtable (GEAR) for 2026 to 2028.
As assessors, we review awareness programmes and training evidence in every PCI DSS assessment where Requirement 12.6 is in scope. Our social engineering and phishing tests show whether that training holds up in practice.
Check your training evidence before your assessment
If you are unsure whether your awareness programme and records will satisfy Requirement 12.6, tell us how your organisation takes card payments and when your next validation is due. We will explain what your assessor will expect to see. Contact our PCI team or call +44 161 523 5276.
Your next step
- PCI compliance checkAnswer 22 questions for a readiness score, your likely SAQ and a fix list.Start the free check
- PCI DSS document indexThe policies, procedures and records each PCI DSS requirement needs, as a free spreadsheet.Get the document index
- Get a PCI quoteTell us how you take card payments and we will confirm your validation route and scope.Get a PCI quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
