12.6 Security awareness education is ongoing
How to meet it
Train personnel at hire and at least annually, covering current threats.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 12.6, in plain English.
12.6.1A formal security awareness program makes all personnel aware of the policy and their role in protecting cardholder data.
12.6.2The awareness program is reviewed at least every 12 months and updated for new threats.
12.6.3Personnel receive awareness training at hire and at least every 12 months, acknowledging the policy annually.
12.6.3.1Training covers threats such as phishing and social engineering.
12.6.3.2Training covers acceptable use of end-user technologies.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
Security awareness and training policyUse for ISO 27001 A.6.3, SOC 2 Security awareness criteria, and PCI DSS requirement 12.6 training obligations.Acceptable use policyUse for ISO 27001 A.5.10, A.6.3, A.6.4, endpoint controls, remote work, and SOC 2 Security awareness.AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Email and communications security policyUse for ISO 27001 A.5.14 and A.8.24, information transfer, encryption in transit, phishing response, and SOC 2 communication controls.
Open the control-to-policy mapBack to Requirement 12, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.