PCI DSS Security Awareness Training by SAQ: What Each Merchant Must Do (2026)

Updated November 12, 2026. Requirement lists checked against the PCI SSC's published SAQ forms and the PCI SSC blog, linked in Sources.

The short answer: how much security awareness training PCI DSS asks of you depends on which Self-Assessment Questionnaire (SAQ) you file. SAQ A has no Requirement 12.6 items at all. SAQ B, B-IP and P2PE ask only for 12.6.1, a formal awareness program. SAQ A-EP, C-VT and C add 12.6.3.1, training that covers phishing and social engineering. SAQ D asks for all five 12.6 requirements, including training on hire and every 12 months with signed acknowledgments.

This page maps each SAQ to its training requirements, shows what "in place" looks like for a small merchant, and lists the records to keep. For the control-by-control reference, see our PCI DSS security awareness training requirements page. This is a plain-English summary, not legal or assessment advice. Your acquirer or a QSA decides which SAQ you are eligible for.

PCI DSS training requirements by SAQ type

Here is what each merchant SAQ includes from Requirement 12.6, based on the SAQ forms the PCI Security Standards Council publishes for PCI DSS v4.0.

• SAQ A (card-not-present, all payment processing outsourced): no 12.6 requirements.
• SAQ B (imprint machines or standalone dial-out terminals): 12.6.1 only.
• SAQ B-IP (standalone IP-connected terminals): 12.6.1 only.
• SAQ P2PE (validated point-to-point encryption terminals): 12.6.1 only.
• SAQ C-VT (manual entry into a web-based virtual terminal): 12.6.1 and 12.6.3.1.
• SAQ C (payment application systems connected to the internet): 12.6.1 and 12.6.3.1.
• SAQ A-EP (e-commerce sites that partly control the payment page): 12.6.1 and 12.6.3.1.
• SAQ D for Merchants (everyone else): 12.6.1, 12.6.2, 12.6.3, 12.6.3.1 and 12.6.3.2.

PCI DSS v4.0.1, published in June 2024, is a limited revision. The PCI SSC says "there are no additional or deleted requirements in this revision," and v4.0 was retired on December 31, 2024. The January 2025 update to SAQ A removed three requirements (6.4.3, 11.6.1 and 12.3.1) and added none from 12.6.

What each 12.6 requirement says

The wording below is from the SAQ D for Merchants form, which carries the full set.

• 12.6.1: "A formal security awareness program is implemented to make all personnel aware of the entity's information security policy and procedures, and their role in protecting the cardholder data."
• 12.6.2: the program is "reviewed at least once every 12 months" and updated as needed for new threats and vulnerabilities.
• 12.6.3: personnel receive training "upon hire and at least once every 12 months," through "multiple methods of communication," and "acknowledge at least once every 12 months that they have read and understood the information security policy and procedures."
• 12.6.3.1: training covers threats to the cardholder data environment, "including but not limited to" phishing and related attacks, and social engineering.
• 12.6.3.2: training covers "the acceptable use of end-user technologies in accordance with Requirement 12.2.1."

12.6.2, 12.6.3.1 and 12.6.3.2 were best practices until March 31, 2025. Since that date they are required and assessed.

SAQ B, B-IP and P2PE: a simple program counts

If you file one of these SAQs, 12.6.1 is your only awareness requirement, and the bar is low on purpose. The SAQ's own completion guidance says the program should be "consistent with the size and complexity of the merchant's operations" and that "a simple awareness program could be a flyer posted in the back office, or a periodic e-mail sent to all employees."

The guidance names the topics that matter most for card-present shops:

• How to lock doors and storage containers.
• How to tell whether a payment terminal has been tampered with.
• How to confirm the identity and business reason of anyone who arrives to service a terminal.

Write those down, share them with every employee who handles cards, and keep a dated copy. That is what "in place" looks like for most small retailers and restaurants on these SAQs.

SAQ C, C-VT and A-EP: phishing and social engineering are now required

These SAQs add 12.6.3.1. Your training content has to cover phishing and social engineering, and the assessor will "examine security awareness training content" to confirm it. A flyer about terminal tampering no longer covers you on its own.

One detail trips people up. The SAQ says email filtering under Requirement 5.4.1 "is not the same as Requirement 12.6.3.1." Technical anti-phishing controls and training are "two separate and distinct requirements, and one is not met by implementing controls required by the other one." A spam filter does not satisfy the training requirement, and training does not satisfy the filter requirement.

Phishing simulations are a practical way to show the content is real and current. They give you dated evidence that employees practiced spotting the exact attacks 12.6.3.1 names.

SAQ D: the full annual cycle

SAQ D merchants carry every 12.6 requirement. That means a written program reviewed every 12 months, training on hire and annually for each person, more than one delivery method, phishing and social engineering content, acceptable-use content tied to your 12.2.1 policy, and an annual signed acknowledgment of your security policy.

The annual clock runs per employee. A single company-wide session in January leaves anyone hired in March overdue by the next March, even though "everyone trained this year" sounds true. Our PCI DSS requirements page covers this failure point in more detail.

Records to keep, by SAQ

• Every SAQ with 12.6.1: a written awareness program, the materials you shared, and the dates you shared them.
• SAQ C, C-VT and A-EP: add training content that visibly covers phishing and social engineering, plus completion records.
• SAQ D: add per-employee training dates from each person's hire date, the 12-month program review, acceptable-use training content, and signed policy acknowledgments.

If you need a starting point for the policies themselves, our free security policy templates include an acceptable use policy, a security awareness training policy and an employee acknowledgment page.

Where PCI DSS training is not enough

Passing your SAQ is a floor, not a program. The PCI requirements say nothing about how often employees practice, whether behavior changes, or how fast people report a suspicious message. Many merchants also answer to cyber insurance questionnaires and, depending on industry, the FTC Safeguards Rule or HIPAA. The same training records can serve all of them if you keep them per employee and dated.

How Hook Security fits

Hook enrolls employees from your directory, so each person is trained from their own hire date rather than a company-wide calendar event. Phishing and social engineering are the core of the curriculum, which lines up with 12.6.3.1, and phishing simulations give you dated practice records. For MSPs that look after retail, hospitality or healthcare clients, the same program runs across every client.

Hook does not guarantee a passing assessment, and no platform can. Compliance depends on your full control environment, your documentation and your assessor.

Bottom line

Find your SAQ first. If it is SAQ A, Requirement 12.6 is not on your form. If it is B, B-IP or P2PE, a short written awareness program covers you. If it is C, C-VT or A-EP, your training must cover phishing and social engineering. If it is SAQ D, you need the full per-employee annual cycle with acknowledgments.

FAQ

Does SAQ A require security awareness training?

No. The SAQ A form has no Requirement 12.6 items. PCI DSS itself still applies to your business, so training remains good practice, but you are not asked to attest to it on SAQ A.

Is phishing training required for PCI DSS?

Yes, for SAQ A-EP, C, C-VT and D. Requirement 12.6.3.1 has been mandatory since March 31, 2025, and it requires training on phishing and related attacks and on social engineering. Email filtering does not count toward it.

How often is PCI DSS security awareness training required?

For SAQ D merchants, Requirement 12.6.3 requires training on hire and at least once every 12 months, plus an annual policy acknowledgment. The other SAQs ask for an ongoing awareness program without a stated training frequency.

Sources

• PCI DSS v4.0 SAQ A (PCI Security Standards Council)
• PCI DSS v4.0 SAQ B (PCI Security Standards Council)
• PCI DSS v4.0 SAQ C (PCI Security Standards Council)
• PCI DSS v4.0 SAQ D for Merchants (PCI Security Standards Council)
• Just Published: PCI DSS v4.0.1 (PCI SSC blog, June 11, 2024)
• Important updates for merchants validating to SAQ A (PCI SSC blog, January 30, 2025)

Keep reading

• PCI DSS security awareness training requirements - the 12.6.3 controls, cadence and what an assessor asks to see.
• FTC Safeguards Rule training requirements - what the rule requires of non-bank financial businesses.
• CMMC Phase 2 suspended: what training still requires - the defense contractor view.
• Free security policy templates - eight ungated policies, including acceptable use and training.
• Best security awareness training platforms (2026, US) - eight platforms compared for US businesses.
• Best security awareness training for MSPs - the MSP vendor landscape.