Guide
PCI DSS online training: what the standard actually requires
PCI DSS online training is how most merchants meet the security awareness requirement. So the content and the completion records both matter to your assessment.
- We prepare, a QSA assesses
- Published price ranges
- Written estimate, no call
What PCI DSS online training must cover
Requirement 12.6 asks for a formal security awareness programme. Also, version 4.0 added specific topics.
- Your card data security policies
- Phishing and related attacks
- Social engineering
- Acceptable use of technology
- How to report a suspected incident
When PCI DSS online training happens
Timing is part of the rule. Therefore training happens on hire and at least once every 12 months afterwards.
| Moment | Requirement |
|---|---|
| New starter | Training on hire |
| Every year | Refresher at least every 12 months |
| Policy acknowledgement | Staff confirm they read the policy |
PCI DSS online training check
Tick what your records can show.
Your result appears here as you tick, so you can see what is still open.
Choosing PCI DSS online training content
Generic courses can work. However, add your own procedures, because staff need to know what to do here, not in theory.
Evidence a QSA looks for
Assessors sample completion records. So keep names, dates and course versions. Also show that new starters trained promptly.
Where we help
We do not sell courses. However, we check that your programme meets the requirement and that records hold up. Policy and documentation work runs $10,000 to $30,000. The standard is in the PCI SSC document library.
Also keep the course current. For example, refresh phishing examples each year, because attack styles change quickly. So the training stays relevant rather than routine. In addition, add a short quiz, because it shows understanding as well as attendance. As a result, the records you show the assessor carry more weight.
PCI DSS online training questions
Is PCI DSS online training acceptable to QSAs?
Yes, if it covers the required topics and records completion.
How often is PCI DSS online training required?
On hire and at least once every 12 months.
Who needs PCI DSS online training?
Personnel with access to the cardholder data environment, and usually everyone in scope.
Do contractors need training?
If they have relevant access, yes.
Related guides
Check your PCI DSS online training programme
Tell us how you train staff today. We reply with a written estimate, usually inside one business day. Also mention how many staff and contractors are in scope, because that shapes the records review. So the estimate is realistic. In addition, share a sample of your current course outline if you have one, because it shows where content gaps sit. As a result, the reply can be specific rather than generic.
Get my written estimate