PCI DSS Security Awareness Training Requirements (12.6)

Content themes

• CHD/SAD handling rules
• Phishing and social engineering
• Secure remote work
• Incident reporting channels

Cadence

Upon hire and at least annually thereafter is the common baseline — confirm exact DSS wording for your version.

Effectiveness

Track repeat offenders and refresh modules after incidents.

How CyberSilo Helps

• Evidence mapping in CyberSilo CSA
• Detection and logging proof with ThreatHawk SIEM
• Advisory scoping — contact CyberSilo

Frequently Asked Questions

Contractors?

Include personnel who can affect CDE security.

Is CBT enough?

Often yes if content and completion are evidenced.

Call centre agents?

Add telephony-specific CHD scenarios.

Related Resources

• Call centres
• PCI hub