What is the Payment Card Industry Data Security Standard?
PCI DSS is the global standard for any organisation that stores, processes or transmits payment card data. Compliance is a condition of accepting card payments, enforced by Visa, Mastercard, American Express, Discover and JCB.
Requirement 12.6 mandates a security awareness programme for all personnel. PCI DSS v4.0, effective March 2025, added Requirement 12.6.3.1 — explicit phishing awareness training. Training is required at hire, annually, and when staff get access to the Cardholder Data Environment.
Non-compliance results in monthly fines, mandatory forensic investigations after breaches, and suspension of card processing — which is existential for most businesses. CyberSek gives you the training and records QSA auditors need.
What happens without PCI DSS awareness?
Most compliance failures trace back to employees who weren’t trained. Here’s what’s at stake.
Losing card payment processing is catastrophic for most merchants. Monthly fines are the warning before suspension arrives.
Requirement 12.6.3.1 is a new mandate in PCI DSS v4.0. QSAs specifically test for it. Not having it is an automatic finding from March 2025.
Call centre, accounts payable and customer service staff are deliberately targeted by fraudsters. Their training directly reduces card data theft.
A card data breach triggers mandatory PCI forensic investigations costing tens of thousands before fines and remediation even begin.
Repeated compliance failures are noted by card brands. Merchants with persistent issues face stricter requirements and higher scrutiny.
Trained employees and dated records — in place in under 10 minutes.
Start free trialPCI DSS training — simple, trackable, audit-ready
CyberSek provides the employee awareness training PCI DSS Requirement 12.6 mandates. We give payment-handling staff the knowledge they need and the records your QSA will ask for. We do not assess or certify PCI DSS compliance.
Employees learn what cardholder data is, why it’s targeted, how to handle it safely, how to spot phishing aimed at payment staff, and what to do if a potential compromise occurs.
PCI DSS awareness modules
2–5 minute video modules. Completion tracked automatically. Certificate issued per employee. Reports ready for auditors.
What cardholder data is, why it’s targeted globally, and what compliance means for every employee
How attackers target card-handling staff specifically — with real scenarios and recognition skills
Voice phishing, pretexting, and impersonation attacks targeting accounts payable and call centres
Screen privacy, clean desk, printing CHD, secure disposal, and everyday handling procedures
OWASP Top 10 and secure development habits for developers who build or maintain payment systems
Spotting a potential card data compromise and the exact internal escalation steps to take
Supply chain attack awareness and considerations when third parties access your payment environment
Securing remote connections to payment environments and the unique risks they create