IT Administrators and Developers
System, Database, and Network Administrators and other staff with privileged access to computer
systems that may store, process, or transmit CHD will require more detailed security awareness training
that includes understanding the importance of secure system configurations for the protection of
sensitive information.
While general security awareness training (as described in Section 3.1) forms the basis for the security
awareness program for these job roles, additional training may be necessary to address the different
methods by which the role handles CHD. It may also be appropriate for these roles to have a general
understanding of the how the organization receives and processes payments.
For specialized roles, such as those who support systems and networks, vendor-provided
recommendations and industry best-practice guides for secure configurations can be useful content to
include in training. For example, the Centre for Internet Security (CIS) provides security benchmarks and
recommended configurations for a variety of systems.
Application developers, system developers, and testing staff have access to underlying code base,
which is critical to environment security. These users should be aware of their responsibilities to follow
the organization’s security policy, secure coding practices, and change control procedures as outlined in
PCI DSS Requirement 6, and be aware of current information on security threats and effective
countermeasures.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.
