Which methods are acceptable for educating personnel per Req 12.6?

• A. Posters, letters, memos, web-based training, meetings, and promotions
• B. Emails only
• C. Newsletters only
• D. Social media only

Answer: (A)

A security awareness program for all personnel with access to card data must use a variety of education methods to be effective. Using a broad mix—posters and letters or memos to reach people in different environments, web-based training for interactive learning and tracking, meetings for real-time discussion, and ongoing promotions or reminders to reinforce the message—ensures the program covers different learning styles and keeps security top of mind across the organization. Relying on a single channel, like only emails, newsletters, or social media, risks missing staff, reducing engagement, or failing to provide the reinforcement needed to change behavior, so that approach would not meet the requirement.