[Autogenerated] requirement 12.6 is concerned with security awareness training.
And again,
remember that the PC I'd CSS requirements only apply to people who process
cardholder data or who can affect the security of the cardholder data
environment to this requirement for security,
awareness may not apply to everyone in your organization.
The requirement is quite simple,
one that the organization needs to develop an awareness or
education program to make sure that all personnel,
in scope of the requirements,
understand the policies and their specific responsibilities.
The QoS a will look at the program documentation to make sure there's a
formal awareness program in place on the key thing to think about here is
the requirement is about the program itself.
On the testing procedure about the program itself is not about the
artifacts that may form part of the program.
There are two sub requirements.
The first is that people are trained when they first joined the organization,
and only after that.
And there's also a hidden requirement in one of the testing procedures,
which is the QoS.
A has got to validate that the awareness program provides
multiple methods of communication and education,
so that could be things like traditional classroom learning,
e learning posters, email reminders, newsletters.
But the key thing that's hidden in the testing requirement is that the
programs got to have multiple methods of communication,
so you can't just have one annual training course.
The rest of the testing procedure matches the requirement in the QoS.
A will look for training records to verify that people were trained on
higher and annually and QoS a will also talk with people and ask them
about their training and what they learned.
The second sub requirements.
One of those horrible compliance box ticking requirements,
which is that all people in scope of PC IDE CSS need to confirm
each year that they've read and understood the security policy
and procedures relevant to them.
The testing procedures interesting because it just
requires the use A to confirm that the awareness program
requires this annual attestation.
It doesn't actually asked the USSA to look at the physical or
electronic records of people's annual confirmation that they'd
read and understood the policies