User Training and Awareness

Applies to. Requirement 12 asks for a formal security awareness programme that makes all personnel aware of the entity's information security policy and of their role in protecting cardholder data. The programme is reviewed at least once every 12 months and updated for new threats; personnel are trained on hire and at least once every 12 months, and acknowledge at least annually that they have read and understood the policy and procedures. Since 31 March 2025 the training must also cover threats to the CDE such as phishing and social engineering, and the acceptable use of end-user technologies.