How often must personnel be educated under 12.6.1?

How often must personnel be educated under 12.6.1?

• A. Only at the time of hire.
• B. Educate upon hire and at least annually.
• C. Monthly for all staff.
• D. Never provide annual refreshers.

Answer: (B)

Security awareness education for anyone who handles cardholder data must be provided when they are hired and at least once every year. This ensures new employees start with a solid baseline understanding and that all staff receive ongoing reinforcement to keep up with evolving threats and policies. Monthly training isn’t required by this rule, and never providing annual refreshers would fail to meet the requirement because the annual update is essential for maintaining awareness.

Security awareness education for anyone who handles cardholder data must be provided when they are hired and at least once every year. This ensures new employees start with a solid baseline understanding and that all staff receive ongoing reinforcement to keep up with evolving threats and policies. Monthly training isn’t required by this rule, and never providing annual refreshers would fail to meet the requirement because the annual update is essential for maintaining awareness.