We're very focused on PCI compliance in our company. We want to start at the source -- the employees -- and make...
By submitting your personal information, you agree that TechTarget and its partners may contact you regarding relevant content, products and special offers.
sure every member of the company is well versed in PCI DSS requirements. It may be somewhat unusual to make PCI compliance a company-wide activity, but I think that working together as a team to stay compliant can help prevent incidents. I want to provide PCI awareness training for my staff, but I'm unsure where to start. I don't think making them read the PCI DSS guide itself will be beneficial. Are there some training programs you could recommend or best practices we can teach our employees to at least cover the basics?
Ask the Expert!
Got a vexing problem for Mike Chapple or any of our other experts? Ask your enterprise-specific questions today! (All questions are anonymous.)
You're definitely on the right track -- making all of the employees in your organization aware of PCI DSS requirements is not only a good idea, it's required by the PCI DSS standard. Fortunately, there are several good programs out there that are designed to ease this burden. For example, you might want to consider the SANS Institute's Securing the Human program (which also provides non-PCI security awareness modules) or the PCI Security Council's noncertification training programs.
As you consider a PCI awareness training program for your organization, I encourage you to include several factors in your analysis:
- Does the program meet the basic requirements of your PCI awareness needs? For example, if you're looking for something to cover a PCI DSS requirement, does the program include content on credit card security?
- Is it possible to kill two (or more) birds with one stone? For example, does the program offer a modularized approach that meets HIPAA training requirements or fill another need within your organization?
- Does the vendor providing the PCI employee training offer automated tracking of who has completed the training program? Will the system provide automated "nagging" of non-participants?
Outsourcing PCI DSS awareness training is also a great way to take some of the burden off internal staff and meet one element of your compliance obligations.
Dig Deeper on PCI Data Security Standard
Related Q&A from Mike Chapple
A proposed cyberattack information database in the U.K. aims to improve cyberinsurance. Expert Mike Chapple explains what collecting data breach ...continue reading
The proposed CFTC regulations on cybersecurity testing are set to finalize in 2016. Expert Mike Chapple discusses the effects these regulations have ...continue reading
Whether Apple is a HIPAA covered entity was called into question when it advertised for a health regulations lawyer. Expert Mike Chapple discusses ...continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.