PCI DSS Security Maturity Model·AWS v1.1.0

Drag to explore · pinch to zoom
Home / Matrix / Requirement 12 / c12.4
Foundational Security GovernanceSecurity domain from the AWS Cloud Adoption Framework (CAF) Security Perspective, used to organize the controls. 👤 CustomerAWS Shared Responsibility Model: who implements and operates this control. Customer = you own it; AWS = AWS operates it and you inherit it; Shared = both have obligations.

c12.4 Security awareness program

Implement a formal security awareness program so that personnel understand their role in protecting account data, with updates as threats emerge.

Quick Wins
Foundational
Efficient
Optimized
Effort: Low Impact: Medium Applies to CDE: No

Requirement 12

Support Information Security with Organizational Policies and Programs

PCI sub-requirements coveredCoverage shown per PCI DSS v4.0.1 sub-control. “Covered” = addressed by this AWS recommendation. “Roadmap” = technical, planned. “Your responsibility” = organizational/process control. “Out of scope” = physical or third-party control not implemented in AWS.

12.6 Security awareness education is an ongoing activity
  • 12.6.1 Security awareness program implemented Your responsibility
  • 12.6.2 Security awareness program reviewed and updated annually Your responsibility
  • 12.6.3 Personnel receive security awareness training Your responsibility
  • 12.6.3.1 Training includes threats/vulnerabilities to the CDE Your responsibility
  • 12.6.3.2 Training includes acceptable use of end-user technologies Your responsibility

How to implement on AWS

Establish training upon hire and at least annually, including phishing and social engineering. Maintain attendance/completion records. Update the content as threats emerge. Reinforce with the technical anti-phishing protection of Requirement 5.4.

Practical implementation

How this control is implemented in each reference architecture:

Train personnel on their role in protecting account data at hire and annually, and reinforce it with the technical anti-phishing controls from Req 5.4.

  1. Deliver security awareness training upon hire and at least every 12 months, including phishing and social engineering.
    Awareness program
  2. Keep attendance/completion records and an annual policy acknowledgement.
    Training records
  3. Reinforce the human control with the technical anti-phishing guardrails from Requirement 5.4 (SPF/DKIM/DMARC, DNS Firewall).
    Email / DNS controls Route 53 DNS Firewall Amazon SES

How to validate: Training records show hire + annual completion, and the technical anti-phishing controls from 5.4 are in place.

Avoid: Once-a-year slides with no reinforcement. Pair training with technical controls and refresh content as threats change.

Single-account, 3-tier →

Awareness is an organizational (not per-account) control: one program for all personnel, tied to the shared technical guardrails.

  1. Run a single awareness program for all personnel across the organization.
    Org awareness program
  2. Tie the shared-account anti-phishing guardrails (from Req 5.4) to the program so training and controls reinforce each other.
    Shared / network account Route 53 DNS Firewall Amazon SES
  3. Keep completion records centrally.
    Org training records Amazon S3

How to validate: One org-wide program with central completion records, backed by the shared anti-phishing guardrails.

Avoid: Separate, inconsistent training per team/account. Run one program and keep central records.

Multi-account with a dedicated PCI OU →

PCI validation

Testing methods: examineinterview

Testing procedures

  • Examine the security awareness program to verify it educates personnel on the security policy and their role in protecting cardholder data (12.6.1).
  • Examine program records to verify personnel attend awareness training upon hire and at least every 12 months, and acknowledge the policy annually (12.6.3.a, 12.6.3.d).

Evidence in AWS

  • Awareness program materials and their schedule.
  • Training completion records for personnel.
  • Content updates in response to new threats.

Customized approach

Requires a targeted risk analysis (Req 12.3.2).

Customized Approach Objective

  • 12.6 — Personnel are knowledgeable about the threat landscape and their responsibility for the operation of relevant security controls.

AWS services

AWS Training and Certification

Learning resources

References

  • PCI DSS v4.0.1 Requirement 12.6