The Payment Card Industry Council thinks Security Awareness Training is so important that they just published a 25-page guidance paper that fully explains the why, how and what of awareness training programs. And they start out with: "In order for an organization to comply with PCI DSS Requirement 12.6, a formal security awareness program must be in place."
The PCI Security Standards Council was founded in 2006 by payment card companies American Express, MasterCard, Visa, Discover and JCB International, and was tasked with educating merchants, and other involved parties handling cardholder data, on the PCI Data Security Standard (PCI DSS), so that compliance could and would be enforced easier.
Troy Leach, the CTO of PCI SSC, said in a statement. "PCI Standards emphasize the importance of people, process and technology when it comes to protecting payment information. This guidance can help businesses focus on the 'people' part of the equation and build a greater culture of security awareness and vigilance across their organizations.”
I was happy to read it, because they got it totally right. The PCI council took their time, discussed with their Special Interest Group (SIG) and came out with a well thought-through, measured and actionable guide; which helps you to get a program in place.
One section highlights the whole message: "One of the biggest risks to an organization’s information security is often not a weakness in the technology control environment. Rather it is the action or inaction by employees and other personnel that can lead to security incidents for example, through disclosure of information that could be used in a social engineering
attack, not reporting observed unusual activity, accessing sensitive information unrelated to the user’s role without following the proper procedures, and so on."
It was encouraging to see that using KnowBe4's Kevin Mitnick Security Awareness Training program, you can fully comply with the PCI requirements. Here is the PDF, downloadable from KnowBe4's content delivery network at Amazon Web Services.
