A tailored course, built for your situation
Deeper command of the PCI DSS control framework
Master the foundational structure behind secure payment processing and compliance assurance
$199 one-time
24-hour access provisioning
30-day money-back guarantee
Hand-built implementation playbook
12 modules. 12 chapters per module. 144 chapters total.
12 modules, each with 12 chapters (144 chapters total), text-based, plus downloadable templates and a hand-built implementation playbook delivered alongside course access.
Who this is for
Senior learning and development leader in financial services with accountability for compliance training programs
Who this is not for
Entry-level trainers, auditors focused on check-the-box validation, or teams using generic PCI DSS slide decks without context
What you walk away with
- Confidently explain the origin and intent behind every PCI DSS requirement
- Map controls to internal policies and training modules with precision
- Anticipate assessor questions and peer challenges with sourced reasoning
- Design role-specific compliance curricula grounded in the full framework context
- Lead internal updates ahead of version changes with full structural understanding
The 12 modules (with all 144 chapters)
Module 1. Structure of the PCI DSS framework
Break down the hierarchy of requirements, testing procedures, and guidance documents to see how the standard is organized and enforced.
12 chapters in this module
- Overview of PCI DSS versions
- Control objective types
- Scope definition mechanics
- Cardholder data environment mapping
- In-scope system identification
- Self-assessment vs ROC paths
- Roles in validation process
- Reporting structure to assessors
- Attestation of compliance flow
- Evidence collection standards
- Control implementation depth
- Common misinterpretations to avoid
Module 2. Requirement 1: Firewall configuration
Master the technical and policy expectations for network security controls protecting cardholder environments.
12 chapters in this module
- Perimeter firewall baseline
- Default deny principle
- Router configuration standards
- Stateful inspection requirements
- Rule documentation practices
- Change management integration
- Review frequency expectations
- Network diagram updates
- Third-party access rules
- Remote administration controls
- Time-bound access setup
- Audit logging for rule changes
Module 3. Requirement 2: System configuration
Understand secure configuration for servers and system accounts that process payment data.
12 chapters in this module
- Default password removal
- Vendor-supplied credentials
- System account naming
- Shared account restrictions
- Authentication protocol standards
- Wireless network security
- SSID broadcasting rules
- WPA2 WPA3 transition
- MAC address filtering
- Wireless intrusion detection
- Configuration baselines
- Secure image deployment
Module 4. Requirement 3: Protect stored data
Learn how encryption, tokenization, and data retention policies apply to sensitive cardholder information.
12 chapters in this module
- Primary account number handling
- PAN truncation rules
- Data retention policies
- Encryption key management
- Key rotation standards
- Cryptographic storage methods
- Tokenization implementation
- Masking in logs
- Database security standards
- Archive storage controls
- Data lifecycle mapping
- Destruction certification
Module 5. Requirement 4: Encrypt transmission
Implement secure data transfer protocols across open networks and internal segments.
12 chapters in this module
- Strong cryptography definition
- SSL TLS deprecation
- Approved encryption standards
- Public network protections
- Wireless encryption
- End-to-end encryption
- Point-to-point encryption
- Key strength requirements
- Certificate validation
- Man-in-the-middle prevention
- Session timeout standards
- Protocols to avoid
Module 6. Requirement 5: Malware protection
Deploy anti-virus and endpoint protection controls across systems in the CDE.
12 chapters in this module
- Malware types covered
- Automated signature updates
- On-access scanning
- Quarantine procedures
- Exclusion documentation
- Review of scan logs
- Policy exception tracking
- Endpoint detection rules
- File integrity monitoring
- Change alert thresholds
- Rootkit detection
- System-specific rules
Module 7. Requirement 6: Secure development
Apply secure coding practices and vulnerability management to payment applications.
12 chapters in this module
- Software development lifecycle
- Code review standards
- Patch management
- Vulnerability scanning
- Web application firewalls
- Input validation rules
- Error handling standards
- Secure configuration
- Third-party component review
- Penetration testing
- Threat modeling
- Change control integration
Module 8. Requirement 7: Access control
Enforce role-based access to cardholder data with documented policies and technical enforcement.
12 chapters in this module
- Least privilege principle
- Role definition process
- Access approval workflow
- User provisioning
- Access review frequency
- Segregation of duties
- Emergency access rules
- Time-bound access
- Access request forms
- Revocation procedures
- Shared account monitoring
- Administrator access controls
Module 9. Requirement 8: Authentication
Implement strong authentication mechanisms for all users with access to CDE systems.
12 chapters in this module
- Password complexity
- Minimum length standards
- Expiration policies
- Reuse restrictions
- Multi-factor authentication
- Physical access integration
- Token device management
- Biometric authentication
- Authentication failure lockout
- Reset process security
- Service account controls
- Remote access authentication
Module 10. Requirement 9: Physical security
Secure physical access to locations where cardholder data is processed or stored.
12 chapters in this module
- Facility access controls
- Visitor sign-in procedures
- Badging systems
- Camera coverage
- Media handling
- Secure disposal
- Equipment inventory
- Data center access
- Lockable cabinets
- Media storage rooms
- Shipping and receiving
- Monitoring frequency
Module 11. Requirement 10: Logging and monitoring
Establish reliable logging, monitoring, and alerting for all system access and changes.
12 chapters in this module
- Event types logged
- Timestamp accuracy
- Log retention period
- Centralized collection
- Integrity protections
- Review frequency
- Security incident criteria
- Log storage security
- Time synchronization
- Monitoring tools
- Alert response process
- Forensic readiness
Module 12. Requirement 11: Vulnerability scanning
Conduct regular internal and external scans to detect system weaknesses.
12 chapters in this module
- External scan frequency
- Approved scanning vendors
- Internal scan schedules
- Penetration testing scope
- Vulnerability severity levels
- Remediation timelines
- Reporting to assessors
- False positive handling
- Patch validation
- Scan coverage confirmation
- Critical system exceptions
- Documentation standards
How this maps to your situation
- Onboarding new compliance staff
- Updating internal training materials
- Preparing for external audit
- Designing role-specific learning tracks
Before vs. after
Before
Relied on surface-level overviews and generic training materials for PCI DSS
After
Confidently lead deep-dive sessions with engineering and security teams using full structural command of the framework
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 3 hours per module, designed for flexible completion across 4-6 weeks.
How this compares to the alternatives
Unlike generic compliance webinars or outdated slide decks, this course delivers structured, chapter-by-chapter command of the PCI DSS framework with direct applicability to training design and internal guidance.
Frequently asked
Who is this course designed for?
Learning and development leaders in financial services who own or contribute to compliance training, especially around payment security.
How is the course structured?
12 modules, each containing 12 chapters (144 chapters total).
Will this help me train technical teams?
Yes, each requirement is broken down with technical precision so you can create accurate, confident training for engineers, auditors, and operations teams.
$199 one-time. Approximately 3 hours per module, designed for flexible completion across 4-6 weeks..
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
30-day money-back guarantee·
144 chapters·
Hand-built playbook included·
Account access within 24 hours