Which of the following best describes the PCI DSS requirement for security awareness training (Req 12.6)?

• A. Provide security awareness on hire and at least annually using multiple communication methods
• B. Provide annual training only
• C. Education only for IT staff
• D. Require monthly quizzes

Answer: (A)

Security awareness training is a continuous program for everyone who handles cardholder data. The requirement is that this training be provided when a person is hired and then at least annually, and it should reach people through multiple methods so the material is understood and retained. This combination—onboarding plus ongoing yearly training, delivered through more than one channel (for example, online modules, in-person sessions, emails, posters, and simulations)—ensures all personnel stay aware of risks and their responsibilities.

The other options don’t fit because annual training alone misses the onboarding moment and continuing reinforcement; restricting education to IT staff excludes non-IT personnel who may still handle data; and monthly quizzes aren’t required or specified as the method for meeting this requirement.