PCI DSS v4.0/Requirement 12: Support Information Security with Organizational Policies and Programs/231 of 250
12.6.3Security awareness education is an ongoing activity
Control family: Requirement 12: Support Information Security with Organizational Policies and Programs
Control description
Defined Approach Requirements:
3 Personnel receive security awareness training as follows:
• Upon hire and at least once every 12 months.
• Multiple methods of communication are used.
• Personnel acknowledge at least once every 12 months that they have read and understood the information security policy and procedures.
Defined Approach Testing Procedures:
12.6.3.a Examine security awareness program records to verify that personnel attend security awareness training upon hire and at least once every 12 months.
12.6.3.b Examine security awareness program materials to verify the program includes multiple methods of communicating awareness and educating personnel.
12.6.3.c Interview personnel to verify they have completed awareness training and are aware of their role in protecting cardholder data.
12.6.3.d Examine security awareness program materials and personnel acknowledgments to verify that personnel acknowledge at least once every 12 months that they have read and understand the information security policy and procedures.