Which statement best describes the goal of Requirement 12.6 in PCI DSS?

Which statement best describes the goal of Requirement 12.6 in PCI DSS?

• A. Limit security awareness to executives.
• B. Provide training only to contractors.
• C. Rely solely on automated monitoring without personnel training.
• D. Implement a formal security awareness program for all personnel.

Answer: (D)

The main idea here is that security awareness isn’t a one-off task; it requires a formal, ongoing program that involves everyone who could interact with cardholder data. Requirement 12.6 focuses on building and maintaining a structured security awareness program for all personnel, not just a subset. This means formal training, regular updates, and continuing education so people know how to handle data securely, recognize phishing and other social engineering, follow policies, and report incidents. The emphasis on “all personnel” ensures contractors, temporary staff, employees, and anyone with access are aligned in how to protect cardholder information, which is essential because human error is a common risk vector. Automated monitoring alone cannot substitute for awareness and behavior; training empowers people to act correctly, not just detect issues. Limiting training to executives or contractors, or relying only on automated controls, would leave gaps in knowledge and practice.

The main idea here is that security awareness isn’t a one-off task; it requires a formal, ongoing program that involves everyone who could interact with cardholder data. Requirement 12.6 focuses on building and maintaining a structured security awareness program for all personnel, not just a subset. This means formal training, regular updates, and continuing education so people know how to handle data securely, recognize phishing and other social engineering, follow policies, and report incidents. The emphasis on “all personnel” ensures contractors, temporary staff, employees, and anyone with access are aligned in how to protect cardholder information, which is essential because human error is a common risk vector. Automated monitoring alone cannot substitute for awareness and behavior; training empowers people to act correctly, not just detect issues. Limiting training to executives or contractors, or relying only on automated controls, would leave gaps in knowledge and practice.