Key Takeaways
- Requirement 12.6 asks for a program, a dated annual review of it, the training, the content and an acknowledgment.
- The standard sets 2 training triggers, on hire and at least once every 12 months, and no role-change trigger.
- The program review is a separate obligation from the training, and it is the layer most hotel programs never schedule.
- VikingCloud found 82% of North American hotels hit by a successful cyberattack over the summer of 2024.
- Those respondents named payment and point-of-sale systems their most vulnerable guest-facing systems at 72%.
A hotel trains everybody every January and files the report. 12 months later an assessor asks for 3 things, and only 1 of them is in that report. The other 2 things are a dated program review and a signed policy acknowledgment per person.
Hotels are a target worth the attention. VikingCloud found 82% of North American hotels hit by a successful cyberattack over the summer of 2024. Those respondents named payment and point-of-sale systems their most vulnerable guest-facing systems at 72%, putting guest Wi-Fi second at 56%.
Those systems are part of the cardholder data environment, which is what brings the card standard into a hotel at all. That standard asks for more than a training completion rate, and requirement 12.6 is short enough to read in a sitting. Reading it once saves an argument during the assessment itself.
What Requirement 12.6 Asks For
The requirement is built in 3 layers and most programs build one. There is a program, there is a review of that program, and there is the training and acknowledgment each person completes. An assessor tests all 3 of those layers separately.
The layer | What it asks for | How often |
|---|---|---|
The program | A formal security awareness program exists | Standing |
The review | The program is reviewed and updated for new threats | At least once every 12 months |
The training | Personnel receive security awareness training | On hire, then at least once every 12 months |
The content | Threats including phishing and social engineering | Covered in the training |
The content | Acceptable use of end-user technologies | Covered in the training |
The acknowledgment | Personnel confirm they read and understood the policy | At least once every 12 months |
Reading down the right-hand column shows where most hotel programs are thin. The training row is the one every hotel runs, and the review row and the acknowledgment row are separate obligations that happen to share the same interval with it. A completion report answers 1 row of those 6, which is why an assessment that looked straightforward turns into a search.
The Review Nobody Schedules
That search usually ends at the review layer, which is the one most often missing entirely. The standard asks for the awareness program itself to be reviewed at least once every 12 months and updated to address new threats and vulnerabilities affecting the cardholder data environment. That is a review of the program, and it is not a review of who completed the course.
Evidence for that review looks different from a completion report. An assessor wants a dated record showing the review happened inside the past 12 months, with any updates noted against it. A program that ran unchanged for 3 years has a training record and no review record at all.
Where the Role-Change Trigger Comes From
Many hotel policies name a third trigger, and the standard does not. That third trigger appears in most templates as a line requiring retraining when somebody changes role in a way that affects their access to the cardholder data environment. The requirement itself sets 2 triggers, which are hire and the 12-month cycle.
Retraining on a role change is sensible practice all the same. The distinction matters because an assessor tests you against the standard and then against your own documented policy. A policy promising a trigger the standard never asked for creates an obligation you now have to evidence.
Your policy is therefore worth reading for 3 phrases that commonly appear in templates and never appear in the requirement:
- Remove any claim that the standard requires retraining on a role change.
- Remove any claim that the acknowledgment is a separate annual requirement outside 12.6.3.
- Remove any fixed course duration, because the requirement states none.
Produce the per-person record without rebuilding a list.
KC LMS assigns from the attributes your HR record already holds and records completion against the person with a date on it.
Who Counts as In Scope
Scope is the other question a hotel answers badly, and it is settled before any of this matters. Getting it wrong changes who every record above is about. The requirement reaches personnel whose role touches the cardholder data environment, which is wider than the finance office. That environment takes in a front desk agent keying a card, a food and beverage supervisor closing a till at the end of service and a night auditor reconciling the day.
Housekeeping and maintenance usually fall outside it, and the boundary is yours to define and document. An assessor reads that boundary before asking for records against it, so a definition quietly excluding the front desk will be noticed. Writing the scope down first makes the per-person evidence question answerable.
What a Qualified Security Assessor Asks to See
Removing the phrases is the easy half, and producing the evidence is the half that takes a system. That system has to answer 3 levels, because an assessor examining 12.6 wants a different artifact at each one.
At the program level they ask whether a formal program exists and whether it was reviewed inside the past 12 months. At the content level they read the training material itself for the topics the standard names, which means phishing, social engineering and the acceptable use of end-user technologies. At the individual level they ask for a completion record and a policy acknowledgment for each in-scope employee inside the current 12-month window.
That third level is where a hotel with high turnover struggles. A property with that turnover hiring 40 seasonal staff in May has 40 new training deadlines and 40 new acknowledgments, and the person tracking them is usually also running the front desk. The evidence exists somewhere in most hotels and nobody can assemble it in the week an assessment lands.
What KC LMS Gives a Hotel Compliance Team
Assembling that evidence is a system problem before anything else. A spreadsheet rebuilt each quarter never survives a seasonal intake. The work lands on whoever is free in the week the assessor arrives.
KC LMS assigns training from the attributes your HR record already holds, so a seasonal hire in May receives the module in their first week without anybody maintaining a list. Completion is recorded against the person with a date on it, and the reporting reads across person, course and assignment, which is the form the individual-level question takes. Native mobile apps cover the staff who are rarely at a desk.
For a hospitality and travel business, the content half moves as fast as the threats do. Pairing that assignment engine with a content library refreshed every week keeps the phishing and social engineering material current in the months between your annual reviews. Your security awareness training then answers all 3 of the assessor's levels from 1 place.
Frequently Asked Questions
1. How often does PCI DSS require security awareness training?
On hire, and at least once every 12 months after that. Requirement 12.6.3 states those 2 triggers. It also requires personnel to acknowledge at least once every 12 months that they have read and understood the information security policy and procedures.
2. Does the standard require retraining when somebody changes role?
No. Many policy templates carry that line and 12.6.3 does not. Retraining on a role change is reasonable practice, and if your own documented policy promises it then an assessor will test you against your policy as well as against the standard.
3. What has to be in the training content?
Awareness of the threats and vulnerabilities that could affect the security of the cardholder data environment, with phishing and social engineering as the usual examples, and awareness of the acceptable use of end-user technologies. Those are 12.6.3.1 and 12.6.3.2.
4. What is the annual program review?
A review of the awareness program itself, at least once every 12 months, updated to address new threats and vulnerabilities. It is a separate obligation from the training, and the evidence is a dated record of the review with any updates noted. A completion report does not satisfy it.
5. What will an assessor ask a hotel for?
Evidence at 3 levels. Whether a formal program exists and was reviewed inside the past 12 months, whether the content covers the named topics, and whether you can produce a completion record and a policy acknowledgment for each in-scope employee inside the current 12-month window.
References
- PCI Security Standards Council. Document Library.
- PCI Security Standards Council. PCI DSS.
- PCI Security Standards Council. Now Is the Time to Adopt the Future-Dated Requirements of PCI DSS v4.
- PCI Security Standards Council. About Us.
- VikingCloud. 2025 State of Hospitality Cyber Report.