GlobalPCI DSS v4.0.1 (June 2024)Hands-on practical

PCI DSS awareness for card-handling staff

A ready-made course you customise for your organisation, with a live session deck and two surveys. You only add the 6 details that are specific to your organisation.

See the live deckSee the full outline
Try the coursePreview the survey
Length
25 min
Lessons
7 lessons
Frequency
At hire + at least every 12 months
Last reviewed
8 Oct 2026
Case practice
What would you do?

Server at a busy restaurant; "vendor tech" says he must replace the handheld

Try it: this is one of 13 interactive activities in the course.

What's included

Three pieces that work together

Copy once, get everything. Learners prepare on their own, you answer questions live, and the surveys tell you what stuck.

Self-paced course

Short lessons with real workplace scenarios, not walls of text.

  • 7 lessons, about 25 minutes
  • 2 video slots (you add the videos)
  • Scenario, tabs, flashcards, sorting activity and quizzes
  • 10-question final check, 80% to pass

Live session deck

An AhaSlides presentation to run after the course, in person or online.

  • 9 slides
  • Quiz, poll, word cloud slides
  • A closing slide for your contacts

Two surveys

Find out what landed, and whether people use it on the job.

  • Post-course feedback, about 2 minutes
  • 30-day check-in
  • Anonymous by default
  • Results feed your next refresher

Learning objectives

At the end of this course, learners can

Each objective and the lesson that covers it.

IDObjectiveSourceWhere it's covered
TO 1.0Achieve ≥ 80% on the final assessment-Whole course
LO 67.1.1Explain why card data is targeted and what PCI DSS isPCI DSS overviewLesson 1: Why the rule exists
LO 67.2.1Identify cardholder data vs sensitive authentication dataPCI DSS 3.2-3.4Lesson 2: What's covered
LO 67.3.1Apply allowed vs prohibited card-handling practicesPCI DSS 3.3, 3.4, 8.2Lesson 3: Allowed vs not allowed
LO 67.4.1Inspect payment terminals for tampering and substitution + your infoPCI DSS 9.5.1.2-9.5.1.3Lesson 4: Inspect the device
LO 67.5.1Respond to suspicious people and devices and report incidents + your infoPCI DSS 9.5.1.3, 12.10Lesson 5: Case practice

Your part: what a template can't do for you

  • Hands-on practical: this classroom course doesn't replace a practical evaluation. The final lesson includes a sign-off checklist for your supervisor.
  • Your workplace details: fill in the 6 highlighted fields so the course describes your own policies, contacts and locations.
  • Records: record completion in your own LMS or record system.

Course outline

7 lessons, about 25 minutes

Minutes per lesson are an estimate, shared out by page count.

ContentInteractiveVideoYou customise
1

Why the rule exists

2 pages

4 min
Before you beginNoteList
The "technician" visitKey factQuizVideo
2

What's covered

2 pages

4 min
Data typesTabs
TermsFlashcardsMatching quiz
3

Allowed vs not allowed

2 pages

3 min
Sort itSorting activity
CheckMulti-select quiz
4

Inspect the device

3 pages

5 min
What tampering looks likeGalleryAccordion
How to inspectStep-by-stepYour infoVideo
Thresholds & dutiesTableQuiz
5

Case practice

2 pages

3 min
Scenario - the surprise repairScenario
Scenario - phone order shortcutScenario
6

Escalate correctly

2 pages

3 min
ReportProcessYour infoYour infoNote
Practical evaluation sign-offChecklistQuiz
7

Final assessment

Assessment

3 min
Final check10 questions80% to passCompletion page

Live deck and surveys

9 slides to run live, two surveys to close the loop

Pink slides are interactive. Both surveys are anonymous; pink questions are written for this course.

TitleTitle + agenda
PollHow many card payments do you take per shift?
QuizWhich can never be stored after authorisation?
Image quizReal reader or overlay?
Content · customiseOur inspection checklist
QuizUnannounced "technician" arrives. You…
Word cloudWhere could someone hide a skimmer here?
Q&AAsk the trainer anything
Closing · customiseWho to contact, and where to find more
Post-course feedback: 11 questions, about 2 min
  1. Overall rating 5 stars
  2. Relevant, realistic, right length, helpful activities agree/disagree grid
  3. What was most useful? multi-select
  4. Confidence before this course, and now 1-5 scale
  5. How often do you inspect your payment terminals? multiple choice
  6. Has anyone ever asked you to write down a card number? multiple choice
  7. How confident are you that you'd notice an overlay or swapped card reader? 1-5 scale
  8. During busy shifts, I still have time to follow card-security steps. 1-5 scale
  9. One thing we should change or add open text
  10. Would you recommend this course? NPS
30-day check-in
  1. Have you used what you learned since the course? multiple choice
  2. How confident are you today? Compare with day 1 1-5 scale
  3. Do you know where to find our device inspection checklist and payment security contact? yes / no / not sure
  4. A moment where the training helped, or where you weren't sure open text
  5. Which topics should the next refresher focus on? ranking

Results show whether people use the training on the job, not just whether they finished it.

Make it yours

6 fields to fill in, and you're ready

Everything else is done. These are the details only your organisation knows; each one is highlighted inside the course.

  • Device inspection checklist and frequency{{DEVICE_INSPECTION_CHECKLIST_AND_FREQUENCY}}
  • Device inventory location{{DEVICE_INVENTORY_LOCATION}}
  • Terminal vendor verify number{{TERMINAL_VENDOR_VERIFY_NUMBER}}
  • Payment security contact{{PAYMENT_SECURITY_CONTACT}}
  • Phone order procedure{{PHONE_ORDER_PROCEDURE}}
  • LMS or record system{{LMS_OR_RECORD_SYSTEM}}

FAQ

Common questions

Can I run PCI DSS awareness for card-handling staff training online?

The course itself is self-paced and online, and the live deck lets you add a live session. Whether online delivery meets your local rules depends on the law that applies to you, so check PCI DSS v4.0.1 (June 2024) or ask your own counsel.

How often is this training needed?

At hire + at least every 12 months.

Who needs this training?

Retail cashiers, restaurant servers, hotel front desk, call-centre agents taking card payments; variant: store supervisors (adds device-inspection log).

What records should I keep?

Record completion in your own LMS or record system, so you can show who finished the course and when. Check the retention period that applies to you in PCI DSS v4.0.1 (June 2024).

Can I edit the content?

Yes, everything. Change the wording, swap scenarios for ones from your workplace, add your logo, or remove parts that don't apply. Keep anything your own law requires you to cover.

Related templates

Often taught together

All Privacy & Security templates →
US federalRequired by law

Security awareness essentials

All employees and contractors · Privacy & Security

35 min
US federal

Phishing & social engineering

All employees; variant: finance/AP and · Privacy & Security

30 min
CaliforniaRequired by law

California consumer privacy (CCPA/CPRA)

Customer service · Privacy & Security

35 min
US multi-stateRequired by law

US state privacy laws overview

Privacy · Privacy & Security

35 min
Last reviewed: 8 October 2026Based on: PCI DSS v4.0.1 (June 2024) - req. 12.6.1-12.6.3.2 (security awareness at hire + every 12 months), 9.5.1-9.5.1.3 (POI dev…Templates are a starting point, not legal advice.

Ready to run it?

Open the live deck to see how the session runs alongside the course and both surveys.

See the live deck