What is PCI DSS Security Awareness Training
PCI DSS Requirement 12.6 makes a formal security awareness program mandatory for every person with access to the cardholder data environment. This page covers the v4.0.1 transition, the targeted training topics 12.6.3 names, and the evidence pattern Qualified Security Assessors sample during a Report on Compliance.
By Dmytro Koziatynskyi Last reviewed
PCI DSS Requirement 12.6 makes a formal security awareness program mandatory for every person with access to the cardholder data environment
The Payment Card Industry Data Security Standard (PCI DSS) is the security baseline maintained by the PCI Security Standards Council, founded in 2006 by the five major card brands (Visa, MasterCard, American Express, Discover, JCB). It applies to every merchant or service provider that stores, processes, or transmits Account Data (PAN, cardholder name, expiration date, service code) or Sensitive Authentication Data (full track data, CAV2/CVC2/CVV2/CID, PINs and PIN blocks). Merchant Levels 1 through 4 are set by annual transaction volume, with Level 1 carrying the highest assessment burden and the only mandatory Report on Compliance signed by a Qualified Security Assessor.
PCI DSS v4.0 was published in March 2022 and v4.0.1 followed in June 2024. The transition from v3.2.1 became mandatory on 31 March 2024, and a second tranche of new v4.0 requirements (originally listed as best practice) became enforceable on 31 March 2025. The training and awareness expectations sit inside Requirement 12, the policy and program family, and were materially expanded in the v4.0 rewrite. Anyone running an annual generic video and a click-through quiz that satisfied a 2018 v3.2.1 assessment now has a real gap to close.
Requirement 12.6 is the anchor: the entity must implement a formal security awareness program. Sub-requirement 12.6.1 requires the program to be implemented in writing. 12.6.2 requires the program to be reviewed at least annually and updated as needed for new threats and vulnerabilities. 12.6.3 requires personnel to acknowledge at least annually that they have read and understood the security policy and procedures, and that they receive targeted training on phishing and other social engineering, acceptable use, password choice and protection, and the protection of mobile devices and use of teleworking technologies. The word personnel covers full-time employees, part-time employees, contractors, and any third party with access to the cardholder data environment.
Training is the cheapest control under PCI DSS with the largest assessment risk. A QSA does not get to spend time on your firewall configuration if your awareness evidence falls apart on the first sample. The 2024 Verizon DBIR attributes 68% of breaches to a non-malicious human element, and almost every public PCI breach forensics report cites a training or access deficiency in its findings. The rest of this page walks through the v4.0.1 sub-requirement structure, three named breach cases with PCI assessment fallout, the eight defense layers RansomLeak maps to, and the evidence pack QSAs accept during a Level 1 ROC.
How PCI DSS governs security awareness and training
Scope: cardholder data environment, connected systems, and people with access
PCI DSS scope is the cardholder data environment (CDE) plus any system component that stores, processes, transmits, or could affect the security of cardholder data. People scope follows the data: every employee, contractor, and third party with access to the CDE or to systems that connect to it. Scope reduction (network segmentation, tokenization, P2PE, hosted payment pages) shrinks the technical footprint but does not remove the awareness requirement for whoever still touches PAN. The first question every QSA asks during 12.6 sampling is who, exactly, sits in scope; the awareness program has to name them.
Requirement 12.6: the formal security awareness program
Requirement 12.6 requires the entity to implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures. Three sub-requirements sit beneath it. 12.6.1 requires the program to be formal and implemented; an undocumented program does not satisfy 12.6.1. 12.6.2 requires the program to be reviewed at least annually and updated as needed for new threats and vulnerabilities, with review evidence (sign-off, date, scope of update). 12.6.3 covers what personnel actually receive: acknowledgment, targeted training, and ongoing reinforcement.
Targeted training topics named in 12.6.3
Sub-requirement 12.6.3 explicitly names the training topics personnel must receive. Phishing and other social engineering, acceptable use of end-user technologies, password choice and protection, and the protection of mobile devices and use of teleworking technologies. This is the list the QSA samples against; if your program runs a 30-minute generic video that does not separately address each topic, the assessor flags it. The v4.0 rewrite added the explicit phishing call-out and the mobile or teleworking call-out, both responses to attack patterns the older v3.2.1 wording did not cover.
Annual personnel acknowledgment and the QSA evidence sample
Personnel must acknowledge at least annually that they have read and understood the security policy and procedures. The acknowledgment is the single most-sampled piece of evidence inside Requirement 12. QSAs ask for the personnel roster, then sample names against the acknowledgment register, the training completion register, and the role-based assignment matrix. Missing or backdated acknowledgments are the fastest way to fail 12.6.3. Modern programs collect the acknowledgment electronically, timestamp it, store the version of the policy the user signed against, and keep the log for the assessment retention window.
Refresh cadence: annual minimum, after material CDE changes, after incidents
Annual is the floor, not the ceiling. The program must be reviewed and updated as needed for new threats and vulnerabilities (12.6.2), and personnel must receive refreshed training when the CDE changes materially (new payment channel, new third-party processor, new tokenization vendor) or after any incident with awareness implications. A QSA who finds a phishing-driven incident in your incident register and no corresponding training update or staff communication will write that gap up. The cadence the strongest programs run is monthly micro-training on the 12.6.3 topics plus annual policy acknowledgment.
PCI DSS v4.0 changes versus v3.2.1 for security awareness
The v3.2.1 wording for Requirement 12.6 was thin: implement a formal security awareness program, educate personnel upon hire and at least annually, require acknowledgment annually. The v4.0 rewrite added the explicit list of targeted topics in 12.6.3, the explicit phishing call-out, the mobile and teleworking call-out, and the explicit annual review and update cycle in 12.6.2. The transition deadline for the new v4.0 requirements was 31 March 2025; assessments after that date are scored against the expanded language. Programs that have not refreshed since v3.2.1 will not pass a v4.0.1 sample.
Real PCI DSS breach cases citing security awareness gaps
2013 Target breach, 40M cards, $202M total cost
Attackers compromised Fazio Mechanical, an HVAC vendor with remote access to Target systems, through a phishing email that delivered Citadel malware. The vendor credentials were then used to pivot into Target networks and deploy POS scraping malware on point-of-sale terminals during the holiday shopping season. Forty million payment card records were stolen along with personal information for an additional 70 million customers. Target paid an $18.5 million multistate consumer settlement, $39.4 million to banks, and the total breach cost was reported above $202 million. PCI assessment subsequently cited third-party access governance and the awareness training of vendors with CDE-connected access; Target tightened third-party onboarding and segmentation controls in the years that followed.
2014 Home Depot breach, 56M cards, $179M settlement
Attackers used credentials stolen from a third-party HVAC vendor to access the Home Depot network and installed custom POS scraping malware that ran for five months across self-checkout terminals in US and Canadian stores. Fifty-six million payment card numbers and 53 million email addresses were exfiltrated. Home Depot reached a $179 million settlement covering consumer claims and bank losses, on top of internal remediation costs reported above $200 million. The PCI assessment fallout focused on vendor access controls, network segmentation, and the security awareness obligations for the third-party workforce holding credentials inside the CDE perimeter; the case became one of the most-cited examples of how 12.6 awareness and 12.8 third-party management interact.
2008 Heartland Payment Systems breach, 130M cards, $140M+ losses
Attackers used SQL injection against a public-facing web application to install a sniffer on Heartland processing networks and exfiltrated approximately 130 million payment card records, the largest known card breach at the time. Direct fines and settlements exceeded $140 million across Visa, MasterCard, American Express, Discover, and bank claimants. Heartland had been certified PCI DSS compliant by its QSA before the breach; subsequent assessment work cited application security training, secure coding practices, and security awareness across the developer workforce among the deficiencies. The case drove the addition of explicit secure-development expectations into PCI DSS and is the canonical example of why 12.6 training must include the development teams who write code that touches PAN.
How RansomLeak satisfies PCI DSS security awareness requirements
12.6.1: Formal documented security awareness program
RansomLeak ships a documented program structure with named owner, documented scope, documented role-based training matrix, and documented refresh cadence. The program document is the artifact your QSA samples to confirm 12.6.1 is implemented in writing rather than as a verbal practice. We provide the template so the program owner inside your security or compliance function does not start from a blank page.
12.6.2: Annual review and update for new threats and vulnerabilities
The training catalogue ships new exercises and refreshes existing scenarios on a monthly cadence, mapped to current attacker tradecraft and named in the release notes. The release log doubles as your 12.6.2 evidence: a dated record showing the program was reviewed and updated for new threats. The same log is what the QSA samples to confirm the annual review actually happened and was substantive rather than a cover-page date change.
12.6.3: Targeted training on phishing and social engineering
The phishing, callback phishing, double-barrel phishing, smishing, QR code phishing, deepfake audio, business email compromise, calendar invite scams, and typosquatting exercises cover the 12.6.3 phishing and social engineering topic in depth. Each exercise drops the learner inside a realistic scenario and ends with feedback that names the cues missed and the verification step that would have caught the attack. The completion evidence per learner satisfies the 12.6.3 sample.
12.6.3: Acceptable use, password choice, mobile and teleworking topics
Mobile Device Security covers the protection of mobile devices and use of teleworking technologies named in 12.6.3. MFA Setup Best Practices and Credential Stuffing Awareness cover password choice and protection. Employee Security Responsibilities and ISMS Policy Awareness cover acceptable use and the policy acknowledgment workflow. Each maps directly to a named topic in 12.6.3 so the QSA can trace the training assignment back to the standard.
12.10: Incident response training and rehearsal
General Incident Reporting and Reporting Culture exercises drill the human side of Requirement 12.10. Personnel learn to recognize a security incident, report it through the published channel without delay, and understand why the gap between detection and report is the window an adversary uses. The exercises also reinforce the no-blame policy that keeps reporting rates high; punishing reporters destroys the culture 12.10 needs.
8.3: Authentication and MFA hygiene
MFA Setup Best Practices and MFA Fatigue Attack exercises cover the human side of Requirement 8.3 and 8.4 (multi-factor authentication for access into the CDE and for all administrative access). Personnel learn how MFA fatigue bombing works, why approving an unsolicited push prompt is the same as handing over a password, and why phishing-resistant factors (FIDO2, passkeys) defeat the adversary-in-the-middle kits that bypass SMS, push, and TOTP.
9.4: Media protection and physical access
USB Drop Attack covers the 9.4 family from the human angle: the unattended USB stick in the parking lot, the unsolicited shipping device, the conference giveaway. Personnel learn why dropped media is a payload-delivery channel and why the only safe response is to surrender the device unread to the security or IT team. The exercise pairs with the physical access controls 9.4 already requires.
6.2: Secure development training for developers in CDE scope
Safe GenAI Usage and Unsafe AI Output Handling exercises cover the developer workforce that writes code touching PAN, addressing the 6.2 secure software development expectations expanded in v4.0. Engineers learn the prompt-injection patterns and the unsafe output handling failure modes that produce the next generation of application-layer vulnerabilities the Heartland case warned about. The exercises ship as part of the same program so the developer cohort is not orphaned.
How RansomLeak makes the PCI DSS awareness program QSA-ready
RansomLeak runs immersive, scenario-based exercises rather than recorded videos and click-through quizzes. Every exercise drops the learner inside a simulated inbox, phone call, SMS thread, or video conference and forces a real decision under realistic pressure. For 12.6.3 evidence, the difference matters. A QSA sampling against the 12.6.3 phishing topic will accept a video-based completion record, but the assessor expectation since v4.0 is that personnel actually receive targeted training that builds the verification reflex, not just sit through a passive playback. Scenario-based completion records ship the same satisfaction signal as the video records, with audit-ready timestamps and learner-identifier columns the QSA can sample.
Programs are scoped by role rather than blasted to all-staff. Personnel with cardholder-touching access (cashiers, AP staff, customer service handling stored cards, IT operations on the CDE) get the full 12.6.3 phishing, mobile, and acceptable-use stack. IT and help-desk staff get the vishing, MFA-reset, and MFA fatigue scenarios that drove the 2023 Scattered Spider campaign and the 0ktapus pattern. Engineering teams writing code that touches PAN get the secure-development and AI-output-handling scenarios that map to 6.2. Executives and finance leadership get the BEC and deepfake-wire scenarios that cover the wire-fraud variant the Pepco and Arup cases made famous. Every assignment is logged with the learner identifier, the exercise slug, the completion timestamp, and the policy version acknowledged.
The export pack is what makes the program QSA-ready. RansomLeak generates a per-learner completion register, a per-exercise topic mapping back to 12.6.3 sub-topics, the policy acknowledgment register tied to the documented policy version, and the dated release log proving 12.6.2 annual review actually happened. The exports ship as CSV and JSON for the QSA workbook, and as SCORM 1.2 and SCORM 2004 packages so the same exercises also drop into Cornerstone, Workday Learning, Docebo, SAP SuccessFactors, or any standards-compliant LMS the customer already runs for HR-led training. The program owner walks into the Level 1 ROC interview with the evidence pack already organized against the 12.6 sub-requirement structure.
What is PCI DSS security awareness training, and what does Requirement 12.6 require?
PCI DSS security awareness training is the formal program every merchant and service provider in scope of the Payment Card Industry Data Security Standard must implement to make personnel aware of the cardholder data security policy and procedures. The anchor is Requirement 12.6 in PCI DSS v4.0.1 (current as of June 2024). Sub-requirement 12.6.1 requires the program to be formal and implemented in writing; 12.6.2 requires annual review and update; 12.6.3 requires acknowledgment plus targeted training on phishing and social engineering, acceptable use, password choice, and mobile or teleworking technologies.
The transition to PCI DSS v4.0 was mandatory by 31 March 2024, with a second tranche of new requirements enforceable from 31 March 2025. Personnel scope covers employees, contractors, and any third party with access to the cardholder data environment. The 2013 Target breach (40M cards, $202M total cost) and the 2014 Home Depot breach (56M cards, $179M settlement) both started with phished third-party vendor credentials, and both PCI assessments cited training and access governance gaps.
Qualified Security Assessors (QSAs) sample personnel rosters, acknowledgment registers, training completion logs, and the dated release log proving the annual 12.6.2 review happened. Programs that ship monthly scenario-based exercises mapped to the 12.6.3 topic list pass the sample; programs running a single annual generic video do not. RansomLeak structures the catalogue and the export pack against the 12.6 sub-requirement structure so the Level 1 ROC interview opens with evidence already organized.
Recommended exercises
Scenario-based simulations that satisfy this framework.
Employee Security Responsibilities
Covers the acceptable use topic named in 12.6.3 and ties personnel to the policy acknowledgment workflow QSAs sample first.
Try the exerciseISMS Policy Awareness
Walks personnel through the documented security policy structure that 12.6.1 requires the program to communicate, generating the acknowledgment record per learner.
Try the exercisePhishing
Drills the phishing topic explicitly named in 12.6.3, the most-sampled subtopic in any modern PCI awareness assessment.
Try the exerciseBusiness Email Compromise
Walks finance and AP teams through the wire-instruction-change pattern that drove $2.9 billion in 2023 IC3 reported losses, satisfying the social engineering side of 12.6.3.
Try the exerciseMFA Setup & Best Practices
Covers the password and authentication side of 12.6.3 and supports Requirement 8.3 multi-factor authentication for CDE access.
Try the exerciseMFA Fatigue Attack
Drills the push-bombing pattern that bypasses MFA when personnel approve unsolicited prompts, the technique behind the 2022 Uber and 2023 Scattered Spider intrusions.
Try the exerciseMobile Device Security
Covers the protection of mobile devices and use of teleworking technologies topic added explicitly to 12.6.3 in PCI DSS v4.0.
Try the exerciseGeneral Incident Reporting
Builds the reporting reflex Requirement 12.10 needs and the no-blame culture that keeps the report-fast behavior alive after personnel realize they clicked a phishing link.
Try the exerciseFurther reading
Deeper guides on adjacent topics.
Related glossary terms
Quick definitions for the terms in this framework.
Frequently Asked Questions
What GRC and security leaders ask about this framework.
What is PCI DSS Requirement 12.6?
Requirement 12.6 of PCI DSS v4.0.1 says the entity must implement a formal security awareness program to make all personnel aware of the cardholder data security policy and procedures. It is the anchor requirement for security awareness inside PCI DSS and applies to every merchant or service provider in scope of the standard.
Three sub-requirements sit beneath it. 12.6.1 requires the program to be formal and implemented in writing. 12.6.2 requires annual review and update for new threats and vulnerabilities. 12.6.3 requires personnel to acknowledge the policy at least annually and to receive targeted training on phishing and social engineering, acceptable use, password choice, and mobile or teleworking technologies.
Does PCI DSS require annual security awareness training?
Yes. Sub-requirement 12.6.3 requires personnel to acknowledge at least annually that they have read and understood the security policy and procedures, and to receive targeted training on the topics named in the standard. Annual is the floor, not the ceiling. Sub-requirement 12.6.2 separately requires the program itself to be reviewed and updated annually for new threats and vulnerabilities.
The strongest programs run monthly micro-training on the 12.6.3 topics with annual policy acknowledgment, because attacker tradecraft shifts inside a 12-month window faster than a single annual session can keep up with. Cadence above the annual floor also generates the dated release log a QSA samples to confirm 12.6.2 review actually happened.
Who needs PCI DSS training (employees, contractors, third parties)?
The standard uses the word personnel, which covers full-time employees, part-time employees, contractors, and any third party with access to the cardholder data environment. The 2013 Target breach and the 2014 Home Depot breach both started with credentials stolen from third-party vendors with CDE-connected access; both PCI assessment fallouts cited the awareness obligations for that third-party workforce.
Scope reduction (segmentation, tokenization, P2PE, hosted payment pages) shrinks the technical footprint but does not remove the training requirement for whoever still touches PAN. The first question a QSA asks during 12.6 sampling is who, exactly, sits in scope; the awareness program has to name them and show training records for each.
What evidence do QSAs look for during a PCI DSS assessment?
QSAs sample four artifacts during 12.6 review. The documented program (12.6.1), with named owner, scope, role-based training matrix, and refresh cadence. The dated review log (12.6.2), proving the program was reviewed and updated at least annually for new threats. The acknowledgment register (12.6.3), tying personnel to the version of the policy they signed and the date. The training completion register (12.6.3), tying personnel to the targeted topics they received.
The personnel roster is then sampled against each register. Missing or backdated entries are the fastest way to fail 12.6.3. Modern programs collect electronic timestamped acknowledgments, log per-learner per-exercise completion with the policy version, and retain the records for the assessment window the entity is operating under.
What changed in PCI DSS v4.0 for security awareness?
PCI DSS v4.0 was published in March 2022 and v4.0.1 followed in June 2024, current as of today. The v3.2.1 wording for Requirement 12.6 was thin: implement a program, educate annually, require acknowledgment annually. The v4.0 rewrite materially expanded the language. 12.6.2 added the explicit annual review and update requirement. 12.6.3 added the explicit list of targeted topics: phishing and other social engineering, acceptable use, password choice and protection, and the protection of mobile devices and use of teleworking technologies.
The transition from v3.2.1 became mandatory on 31 March 2024, and a second tranche of new v4.0 requirements (originally listed as best practice) became enforceable on 31 March 2025. Programs that have not refreshed against the expanded 12.6 language since the v3.2.1 era will not pass a v4.0.1 sample.
What targeted training topics are required under 12.6.3?
Sub-requirement 12.6.3 explicitly names four topics personnel must receive targeted training on. Phishing and other social engineering. Acceptable use of end-user technologies. Password choice and protection. The protection of mobile devices and the use of teleworking technologies. Each topic is sampled separately by the QSA; a single generic video that mentions none of them by name will not satisfy 12.6.3.
The strongest programs ship a separate exercise per topic, log completion per learner per exercise, and keep a topic-to-sub-requirement mapping document so the QSA can trace each completion record back to the standard. The v4.0 rewrite added the explicit phishing call-out and the mobile or teleworking call-out, both responses to threat patterns that the older v3.2.1 wording missed.
How is PCI DSS training different from SOC 2 or ISO 27001 awareness?
SOC 2 and ISO 27001 both require security awareness training (CC1.4 in SOC 2, A.7.2.2 in ISO 27001), but the wording is principle-based and gives the entity wide latitude on topics, cadence, and evidence format. PCI DSS Requirement 12.6 is prescriptive: it names the topics, names the cadence (annual minimum), names the audience (personnel with CDE access including third parties), and the QSA samples to a published expectation rather than to the entity's own definition.
In practice, programs running PCI DSS comfortably are also running SOC 2 and ISO 27001 comfortably; the inverse is not always true. A SOC 2 program scoped to a single annual all-hands video can pass the SOC 2 audit and still fail the PCI 12.6.3 topic sample. The two-way map matters when the same workforce is in scope for both standards.
Does e-commerce code-only access to PAN still trigger 12.6?
Yes. Requirement 6.2 covers secure software development, and any developer writing code that processes, stores, or transmits cardholder data is in scope of both 6.2 and 12.6. The 2008 Heartland Payment Systems breach (130M cards, $140M plus losses) started with a SQL injection vulnerability in a public-facing web application; the subsequent PCI assessment cited application security training and secure coding practices in the developer workforce among the deficiencies.
Hosted payment pages, redirect flows, and iframe integrations reduce the application surface but do not remove the awareness requirement for the engineering teams that still write the surrounding code. The strongest programs include a developer-scoped track inside the 12.6.3 program covering secure coding, OWASP categories, and (since v4.0.1) the AI coding assistant and prompt-injection patterns the older standard wording did not anticipate.
Sources & further reading
Primary sources cited above and adjacent guidance.
- PCI SSC Document Library — PCI Security Standards Council
- PCI DSS v4.0.1 Quick Reference Guide — PCI Security Standards Council
- Information Supplement: Best Practices for Implementing a Security Awareness Program — PCI Security Standards Council
- 2024 Data Breach Investigations Report — Verizon
- Cost of a Data Breach Report 2024 — IBM
Make This Framework Audit-Ready
Book a 30-minute walkthrough. We will scope the exercise sequence, the assignment logic, and the evidence export your auditor expects.