PCI DSS v4.0: What the training requirement means for your organization

PCI DSS version 4.0, released in March 2022 and fully effective by March 2025, introduced significant changes to the security awareness training requirement. If your organization handles cardholder data, understanding these changes is essential for maintaining compliance and passing your next assessment. Here is what changed, who needs training, and how to satisfy the requirement.

What changed from v3.2.1 to v4.0

In PCI DSS v3.2.1, Requirement 12.6 addressed security awareness but was relatively brief. Version 4.0 expands and clarifies the requirement significantly. The new standard requires that security awareness training is provided to all personnel upon hire and at least annually thereafter. It also adds requirements for targeted training for personnel with elevated privileges and those who interact with cardholder data.

Who needs training under v4.0

The requirement applies broadly. All personnel must receive general security awareness training. In addition, personnel with elevated access privileges, including administrators and developers, must receive targeted training specific to their responsibilities. Anyone who handles cardholder data or has access to the cardholder data environment (CDE) must understand their specific obligations.

What the training must include

PCI DSS v4.0 does not prescribe a specific curriculum, but it does list expected topics. Training should cover: the organization's security policies and procedures; the handling of cardholder data; threats to the security of cardholder data, including phishing and social engineering; incident reporting procedures; and the employee's specific role in protecting cardholder data. Targeted training for privileged users should address additional topics like secure configuration and access control.

How to document compliance for your QSA

Your Qualified Security Assessor (QSA) will need to verify that training was delivered, that it covered the required topics, and that all relevant personnel completed it. Documentation should include: training materials or a curriculum outline; a roster of trained personnel with completion dates; evidence of completion, such as certificates or signed acknowledgments; and evidence that training is provided upon hire and at least annually. The more organized your documentation, the smoother your assessment will be.

Common pitfalls to avoid

The most common compliance failures around training are: incomplete coverage, where some personnel are missed; infrequent training, where annual sessions are skipped; lack of documentation, where completion is assumed but not recorded; and outdated content, where training does not reflect current threats or policies. Each of these can result in a finding during assessment and may require remediation.

A practical approach

The most efficient way to satisfy PCI DSS v4.0's training requirement is to use a standardized program that covers all required topics, delivers training automatically, and generates the documentation your QSA needs. Look for a platform that provides named certificates, unique completion IDs, and an exportable completion report. This turns a compliance obligation into a simple, repeatable process.