PCI DSS Compliant Security Awareness Training: A Comprehensive Guide

The Payment Card Industry Data Security Standard (PCI DSS), designed to reduce the risk of credit card fraud, governs the handling of credit cards and the use of cardholder data. Whenever a transaction is made using any form of electronic payment, sensitive financial data passes through a complex system of merchant networks, banks, credit card companies and card processors. To help reduce the risk of credit card fraud and ensure personal and financial information is kept as secure as possible, it’s mandatory that each of these companies comply with the PCI DSS standards. 

Requirement 12.6 of PCI DSS mandates that all organizations implement a formal security awareness training program. Security awareness training solutions typically comprise computer-based applications that deliver regular training to employees on a range of security concepts. Training materials vary widely from program to program, but the most popular solutions offer a combination of videos, animations, quizzes, presentations, and micro-learning materials, to keep users engaged and increase their knowledge retention to cultivate good practices long-term. 

In this article, we’ll take an in-depth look at PCI DSS compliant security awareness training. We’ll cover what it means to be PCI compliant, and which organizations need to be PCI compliant. We’ll also cover what the specific requirements are when it comes to PCI compliance and security awareness training, and the features you need to look for to ensure that your awareness training campaign is successful. 

What Is PCI DSS And Who Needs To Be Compliant? 

PCI DSS is a set of security requirements that mandate a minimum standard of security controls for organizations that manage payment card data. 

There are 12 requirements in total, each with multiple sub-requirements, that cover best practices for organizations that deal with financial data. They are designed to significantly reduce credit and debit card fraud, and help to keep digital transactions secure—goals which are increasingly important as rates of credit card fraud continue to surge. 

All merchants and service providers that process, transmit, record and store cardholder data must be compliant with PCI DSS requirements. This typically includes those in the financial, retail, transport, and hospitality sectors. 

Compliance with PCI DSS is becoming increasingly important with the explosion in popularity of online digital services, including eCommerce organizations and SaaS applications that handle financial information. It can be a significant challenge for these organizations to achieve and maintain compliance without guidance—which is why it’s important that you choose not just any security awareness training program, but one which highlights the importance of PCI DSS compliance and how it can be achieved. 

PCI And Security Awareness Training

Requirement 12.6 of PCI DSS states that organizations must “implement a formal security awareness program to make all personnel aware of the importance of cardholder data security.” This applies to organizations of all sizes.

Security awareness training solutions provide continuous training and support to users about a range of security topics and best practices. Although commonly used for compliance use cases, security awareness training solutions provide a range of benefits to organizations, including strengthening their human line of defense against cyber threats. In fact, some studies have found that implementing a strong awareness training solution can reduce the risk of cyberattack by up to 75%.

The awareness training requirement comes under a general requirement for organizations to implement and maintain an “information security policy.” Security awareness training is an important piece of this, ensuring users are part of a security culture that protects sensitive and personal user information. 

The Penalties For PCI DSS Non-Compliance

PCI DSS regulations are not written into law; they are industry self-regulated, enforced via contracts between vendors. Complying with all 12 requirements can be extremely time consuming, but non-compliance can have enormous repercussions for your organization. 

Credit card companies can award penalties of up to $100,000 per month to non-compliant organizations, depending on the volume of transactions. Banks can also refuse credit payments from non-compliant merchants. 

PCI DSS compliance, including implementing security awareness training, is designed to reduce the likelihood of your business being affected by a data breach. Data breaches, whether a result of cyberattack or simple human error, can be devastating to organizations. The average cost of a data breach has risen to a staggering $3.86 million USD, and the increase of data regulations such as GDPR in Europe and CCPA in California, mean that organizations that do not protect customer data can find themselves facing hefty fines. 

In addition, companies that get hit by data breaches can hugely damage their reputation and become the target of lawsuits from customers whose data has been leaked or stolen. For these reasons, it’s vital that your financial organization complies with PCI DSS, as well as implement a strong security and user awareness training program that can reduce your risk of data breach. 

The Benefits Of Security Awareness Training 

Security awareness training provides a range of benefits that can improve the overall security of your organization. Here are some of the key reasons you should implement a security awareness training solution:  

Ensure PCI DSS Compliance 

Security awareness training will help you tick that box and achieve PCI DSS compliance. Many security awareness training vendors will offer specific training modules focused on PCI DSS compliance, but any good solution will include training material to help users learn data protection best practices and follow password policies, for example. 

Improve Your Security Culture 

Security experts will tell you that the most successful organizations are those which create a strong security culture that brings everyone into the security conversation. Zach Eikenberry, CEO of Hook Security, tells us that: “You should invite everyone into the conversation. If the organization realizes that everybody had input into the training, it creates a different level of ownership.”

Too often, users see the IT or security department as working against them, doling out mandatory, time-consuming training materials and trying to catch them out with simulated phishing attacks. But the best awareness training solutions can help foster a better security culture, wherein users are aware of security issues and happy to report problems to admins without fear they will be blamed or punished.

This creates a better workplace culture when it comes to managing cybersecurity issues and puts users and organizations in a much better position to protect themselves against data breaches. 

– Zach Eikenberry, CEO Hook Security

Mitigate Social Engineering And Human Error

Human error is one of the leading causes of data breaches and account takeover, with research finding it is a contributing factor in 95% of data breaches. Human error can come in many forms, including the use of weak passwords, reusing passwords across multiple accounts, failing to update operating systems and devices, or downloading malicious applications. 

Awareness training reduces the likelihood of a breach caused by human error, by educating users about potential behaviors that can lead to security breaches and giving people clear advice about how to avoid them. While human error can never be entirely eliminated, security awareness training is one of the best ways of helping users to learn about the risks associated with poor security practices. 

One of the worst ways that human error is exploited by cybercriminals is in the case of social engineering attacks, such as phishing. Social engineering involves the use of fake emails, SMS messages, webpages or even phone calls that attempt to trick users into making fake payments or unwittingly revealing passwords. Phishing attacks like these were the most common type of cybercrime in 2020, with incidents doubling over the past year according to the FBI. 

Security awareness training solutions often focus on preventing phishing attacks. Many of the best solutions include modules focused on spotting and preventing this specific threat, and offer dedicated phishing testing, which allows admins to send out simulated phishing campaigns to users via email. This has two important benefits: it allows end users to see what phishing attacks look like and learn to avoid them, and it helps admins target training more effectively, reducing the overall risk of phishing attack. 

Increase Visibility For Security Teams 

One of the most important benefits that awareness training can offer is the ability to measure and track how aware your users are about security risks. Awareness training courses often include quizzes and metrics that give security teams crucial data about which areas users need more support with, highlighting areas where the organization may be at more risk of attack. 

Conducting simulated phishing attacks can also help you gain visibility over who within your organization is at risk of social engineering. The best solutions offer in-depth reports that highlight which users are failing simulated phishing attacks, allowing security teams to direct relevant training materials to those who need them. Users should also be able to report suspicious emails from their inbox, allowing IT teams to see who is doing well when it comes to spotting malicious emails. 

These reports are also useful for demonstrating compliance. They can be exported to prove that an awareness training campaign was in place, with clear metrics around course completion, engagement, and improvement in security behaviors. 

Implementing A PCI DSS Compliant Awareness Training Solution

In the PCI Security Standards guide to “Best Practices for Implementing A Security Awareness Program”, they recommend looking for an “on-going solution”, conducted over months or weeks rather than just as a once-a-year exercise, as these are more likely to create a lasting security culture. 

They also recommend implementing a solution that provides content for everyone in the organization, but with content packages targeted towards specific users, including management, specialist roles, cashier and accounting staff, the procurement team, and IT admins and developers. 

When implementing an awareness training solution, it’s important to consider the specific use cases of your organization. You need to first understand your training needs, and understand which content works best for your users, and then look for a solution that matches this specific set of requirements. 

In addition, Expert Insights recommends looking for the following key features in any awareness training solution you choose.

Key Features To Look For In PCI DSS Compliant Awareness Training

Engaging Content That Covers A Range Of Topics

The most important aspect of any awareness training solution is the training content itself. If content is boring, unengaging, and unmemorable, employees will quickly disregard it. You may tick the compliance box running an awareness training program like this, but you won’t gain any of the long-term benefits that a high-quality awareness training campaign can provide. The best solutions shouldn’t lecture or patronize employees, but work with them to improve behaviors. 

The best awareness training solutions offer engaging, high-quality content that suits a range of different personalities and organizational cultures. All people respond differently to different types of learning, and awareness training should reflect that with a broad range of content types. Typically, training providers should offer a combination of high-quality videos, featuring live action actors or high-quality animations, audio, and visual content, use a mixture of comedy or quality storytelling to engage users, and incorporate gamification, allowing users to actively participate in training materials. 

It’s also important that, as well as being of a high quality, the content itself is well researched, written by security experts, and covers a broad range of security topics. Some essential topics that your awareness training should include are phishing attacks, passwords and authentication, security in the cloud, internet and email use, and best practices when working remotely. 

Customizable Phishing Simulation Campaigns

Phishing simulations can be one of the best ways to build up a strong immunity to phishing in the organization, by exposing users to what phishing attacks look like and teaching them how to detect and report them effectively. The best phishing simulation campaigns should be easy to deploy, especially with cloud email services like Office 365 and Google Workspace. You should be able to easily add groups of users with your Active Directory and send out regular simulated campaigns every month. 

In addition, campaigns should be highly customizable. There should be a set of pre-built templates, but admins must be able to edit these to more accurately reflect the phishing attacks their organization is actually facing, to make the attack scenarios even more realistic. In addition, admins should be able to change the landing page if a user does click on a link in a “phishing” email, so that employees are able to see they have made a mistake and correct it in future. 

Another important feature for a strong phishing simulation tool is the ability for users to report suspicious emails. This is a key indicator of how well employees are improving in security awareness; the more emails that are successfully reported, the less likely it is that users will fall for a phishing attack. 

Finally, simulated phishing campaigns should provide a wide range of reports and analytics to demonstrate when emails have been sent, who has failed the simulations, company-wide success rates and where more training needs to be directed. 

Strong Compliance Credentials

The best security awareness training providers offer training specifically designed for compliance use cases. The best solutions will offer dedicated annual compliance courses on top of the regularly scheduled awareness training content material for everyday use cases. 

In the case of PCI compliance, we’d recommend looking for a solution with courses specifically designed to help employees learn how to effectively protect payment card information.

Easy Onboarding And Integrations 

One of the most important features of an awareness training solution is ease of deployment and integration into your existing databases and systems. Your chosen awareness training solution should offer options for onboarding users via integrations with Azure Active Directory or other user databases, making it much easier to initially deploy. It should also be very easy to set up rolling campaigns, phishing simulations, and automated reports for easy monitoring of campaign performance. 

The best awareness training solutions allow admins to launch campaigns in just a few minutes. Features to look out for include automated course enrollments, automated reminder emails to end users, and automated reports for admins. These automations should be customizable. Another strong feature to consider is the ability to auto-enroll people who fail phishing simulations into additional training, helping to support their learning development. 

For the majority of organizations, we’d recommend a cloud-based awareness training solution. Market leading cloud-based solutions deploy in just a few moments and make it easy to enroll users and manage the platform moving forwards. 

Reporting And Analytics 

The final—and one of the most important—features we’d recommend organizations look for is a range of reports and analytics. This enables you to track your return on investment, measure the improvement of users who have enrolled in training, track individual employee progress, and demonstrate PCI compliance. 

The best solutions display metrics for the organization, for groups of users, and for individual users. Useful reports to look out for include performance in awareness training quizzes, pass/fail rates for simulated phishing campaigns and organization-wide improvement tracking. 

All reports should be customizable, and it should be possible to automate the creation of reports to be scheduled monthly or quarterly. We’d also recommend looking for a solution that supports integrations with reports via API, so you can connect data to any existing tools you use for data analysis. 

Ensuring The Success Of PCI DSS Compliant Awareness Training  

The best awareness training campaigns are ongoing, with high-quality training materials and simulated phishing campaigns. But even the best solutions can be unsuccessful if they’re not implemented with the right use cases in mind. Here’s our advice on how to ensure the effectiveness of an awareness training campaign:  

Don’t treat training as a “check box” activity: You will see the best results with awareness training when the solution is thought of as an important security tool, not just a compliance activity done to check a box. As we’ve seen, the best solutions can provide numerous benefits and can help to create a much more effective and secure workplace but, for this to work, you have to make sure that users and admins are engaging with training, not just doing it for compliance reasons. 

Involve the whole team and listen to employees: Security awareness training works best when everyone in the organization is involved with choosing an awareness training program and feels part of the decision-making process. While in a larger organization this can be difficult to achieve, it’s important to try and ensure that the training content is a match for your organizations’ culture. Look for a solution that can fit the needs of everyone in your organization; some animation styles or content types may not be a fit for a more corporate environment, for example. 

Make training a positive experience: Creating a security culture is not about blaming a user who struggles with training or cannot identify a simulated phishing attack first time. It’s about creating a workplace environment where users are empowered to make the right security behaviors and are confident to report potential problems without fear of being reprimanded if a mistake has been made. 

Summary

Implementing a robust security awareness training solution is critical to becoming PCI DSS compliant. But, just as importantly, security awareness training can be key to creating a positive security culture throughout your organization, both to protect your data, and to make sure your users are able to protect themselves. 

We recommend that organizations look for awareness training solutions that provide engaging, high quality training, with simulated phishing capabilities, detailed reports, and easy configuration and onboarding. Implementing a solution that meets these criteria is an important first step to PCI DSS compliance but, crucially, can also help your organization to prevent data breaches.