Framework № PCI DSS 4.0 от 01.03.2022

12.6.3
Defined Approach Requirements: 
Personnel receive security awareness training as follows:

Customized Approach Objective:
Personnel remain knowledgeable about the threat landscape, their responsibility for the operation of relevant security controls, and are able to access assistance and guidance when required. 

Defined Approach Testing Procedures:

Purpose:
Training of personnel ensures they receive the information about the importance of information security and that they understand their role in protecting the organization. 
Requiring an acknowledgment by personnel helps ensure that they have read and understood the security policies and procedures, and that they have made and will continue to make a commitment to comply with these policies. 

Good Practice:
Entities may incorporate new-hire training as part of the Human Resources onboarding process. Training should outline the security-related “dos” and “don’ts.” Periodic refresher training reinforces key security processes and procedures that may be forgotten or bypassed. 
Entities should consider requiring security awareness training anytime personnel transfer into roles where they can impact the security of account data from roles where they did not have this impact. 
Methods and training content can vary, depending on personnel roles. 

Examples:
Different methods that can be used to provide security awareness and education include posters, letters, web-based training, in-person training, team meetings, and incentives. 
Personnel acknowledgments may be recorded in writing or electronically. 

12.6.3.2
Defined Approach Requirements: 
Security awareness training includes awareness about the acceptable use of end-user technologies in accordance with Requirement 12.2.1. 

Customized Approach Objective:
Personnel are knowledgeable about their responsibility for the security and operation of enduser technologies and are able to access assistance and guidance when required. 

Applicability Notes:
This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment. 

Defined Approach Testing Procedures:

Purpose:
By including the key points of the acceptable use policy in regular training and the related context, personnel will understand their responsibilities and how these impact the security of an organization’s systems.