PCI Security Awareness Training: What Requirement 12.6 Asks

What Requirement 12.6 says, line by line

Requirement 12.6 sits under Requirement 12 of PCI DSS v4.0.1, “Support information security with organizational policies and programs,” and opens with a sentence: “Security awareness education is an ongoing activity.” Below it come 5 testable lines. The left column is the Council's wording; the right column is what each line means behind a small shop's counter.

The training also leans on the policy lines. The policy it teaches must be “Disseminated to all relevant personnel” (12.1.1), and the policy must define security roles so that “all personnel are aware and acknowledge their information security responsibilities” (12.1.3). If you have no written policy yet, the PCI policy template builds one with a training section and a sign-off table already in it.

What it does not ask for

Read those lines again and notice what is missing. The standard sets the timing (on hire, then at least every 12 months), the topics (the policy, phishing, social engineering, acceptable use), the method (more than one) and the proof (a yearly acknowledgement). It does not set a length, a provider or a test.

So a bought course and a talk in the back room before opening can both meet it. What matters is that the content fits your shop and that you can show it happened. A paid course still needs your part: the shop's own policy, the terminal checks if you take cards in person, and the signatures. The same holds the other way: if you run it yourself, run it properly and keep the record.

Phishing and social engineering at the counter

12.6.3.1 is one of the lines that became required in 2025, and it names its topics: “Phishing and related attacks” and “Social engineering.” Phishing is the message that gets someone to click, sign in or open a file. Social engineering is the wider con, by phone or in person, that talks someone into handing over access or data.

One trap sits in the applicability notes. A spam filter does not meet the training line, and training does not meet the filter line. The standard says they are “separate and distinct requirements, and one is not met by implementing controls required by the other one.”

Source: PCI SSC, Prioritized Approach Tool for PCI DSS v4.0.1, 5.4.1 and 12.6.3.1, read on 2026-10-22

What to train is the shop's own version of the con. These are the shapes it takes at a small counter; swap in the ones your staff actually see.

Counter staff and the card terminal

If you take cards in person on a terminal, another training line applies, and it sits in Requirement 9, not 12. 9.5.1.3: “Training is provided for personnel in POI environments to be aware of attempted tampering or replacement of POI devices.” A POI (point of interaction) device is the terminal the customer dips, taps or swipes. The requirement lists what the training includes:

1. 01“Verifying the identity of any third-party persons claiming to be repair or maintenance personnel, before granting them access to modify or troubleshoot devices.”Check the visitor with the owner or the processor before they touch the terminal.
2. 02“Procedures to ensure devices are not installed, replaced, or returned without verification.”No terminal arrives, gets swapped or goes back in the post unless the owner has confirmed it.
3. 03“Being aware of suspicious behavior around devices.”Someone leaning over the terminal, unplugging it, or asking to “just check” it.
4. 04“Reporting suspicious behavior and indications of device tampering or substitution to appropriate personnel.”Tell the named person at once, and stop using a terminal that looks wrong.

Source: PCI SSC, Prioritized Approach Tool for PCI DSS v4.0.1, 9.5.1.3, read on 2026-10-22

The training rides with the terminal jobs beside it. 9.5.1.1 asks for an up-to-date list of terminals with “Make and model,” “Location” and “serial number or other methods of unique identification,” and 9.5.1.2 asks for terminal surfaces to be “periodically inspected.” How often is yours to set in a targeted risk analysis (9.5.1.2.1, done the way 12.3.1 describes). Staff can only spot a swapped terminal if they know what the real one looks like, so show them the list and the serial number sticker during training.

Which SAQs carry the training lines

Your Self-Assessment Questionnaire decides which questions you answer. SAQ D covers every requirement, so an SAQ D merchant answers all of 12.6, and our PCI deadline calendar puts the yearly training date on SAQ A-EP, C-VT, C and D calendars, the same four our checklist carries the 12.6 line for. Here is where our PCI compliance checklist puts the training lines, SAQ by SAQ.

That is our checklist's reading, not the Council's form. “Check your form” means our checklist has no such line for that SAQ; the SAQ itself has the final list of questions. Before you start one, confirm with your acquirer that you are eligible for it. Training staff is worth doing whatever your SAQ asks, since phishing and a fake call from “the bank” work on any shop.

Keeping the record

Training that left no paper is hard to show. Keep one folder, or one shared drive folder, next to the security policy. These are the pieces that answer the 12.6 questions without a search:

• The outline you ran, with the date and who ran itReq. 12.6.1
• The signed acknowledgement sheet, one per sessionReq. 12.6.3
• A line per new starter: hire date and training dateReq. 12.6.3
• A note of the yearly review and what you changedReq. 12.6.2
• Terminal list and a note of each inspection, if you have terminalsReq. 9.5.1.1–9.5.1.2

One more training line belongs to the people who would handle a breach. 12.10.4 says they are “appropriately and periodically trained on their incident response responsibilities,” and how often is set in your targeted risk analysis (12.10.4.1). In a small shop that may be the owner alone, and the yearly session is a natural time to walk through the plan. The PCI incident response plan template gives you the plan to walk through.

Quick reference