What is the objective of the formal security awareness program?

• A. To ensure all personnel are aware of the importance of cardholder data security
• B. To train only developers
• C. To document policies without training
• D. To monitor vendor performance

Answer: (A)

The main aim is to ensure every person with access to cardholder data understands why security matters and how to protect it. A formal security awareness program is an ongoing, comprehensive training effort that teaches all personnel—employees, contractors, and others with access—about the importance of protecting cardholder data, the organization’s security policies, and practical steps to follow in day-to-day work. It also covers recognizing phishing and social engineering, proper data handling, and how to report security incidents, so safe behavior becomes routine.

This broad, inclusive focus is why the option that targets all personnel is the best fit. Training only developers misses the fact that many others interact with systems and data, and simply documenting policies without training doesn’t ensure people actually apply them. Monitoring vendor performance is a separate concern tied to third-party risk, not the awareness program for internal staff.