Payment Card Data Security (PCI DSS) Fundamentals Training
A one-day fundamentals programme on PCI DSS. Learn how businesses handle payment card information securely and understand their PCI DSS responsibilities. Participants work through practical examples and a guided case before drafting actions for their own organisation.
Who should attend: Payments, finance, retail operations, IT, security, compliance and procurement staff. No prior framework knowledge is required.
HRD Corp claim support available
Programme Agenda
9:00 AM to 10:00 AM
Payment Data and PCI DSS
Introduce PCI DSS v4.0.1, cardholder data and sensitive authentication data. Follow a payment from customer to processor and distinguish a card scheme security standard from a Malaysian statute.
10:00 AM to 10:15 AM
Break
10:15 AM to 11:30 AM
Scope and Third Parties
Identify the cardholder data environment, connected systems and outsourced payment services. Discuss segmentation and tokenisation at a beginner level without assuming outsourcing removes all merchant responsibilities.
11:30 AM to 12:30 PM
Protecting Data and Access
Explore secure configuration, encryption, access restrictions and authentication. Recognise data that must not be retained after authorisation and the need to minimise payment data exposure.
12:30 PM to 1:30 PM
Lunch
1:30 PM to 2:45 PM
Maintaining Secure Operations
Introduce vulnerability management, secure changes, logging, testing and incident response. Match responsibilities to operational owners and identify evidence needed throughout the year.
2:45 PM to 3:00 PM
Break
3:00 PM to 4:00 PM
Validation and Assurance
Explain the purposes of self-assessment questionnaires, assessment reports and attestations at an overview level. Direct scope and validation questions to the acquirer and qualified assessor where applicable.
4:00 PM to 5:00 PM
Practical Exercise: A Retail Payment Flow
Map a fictional store and online checkout. Identify data exposure points, supplier responsibilities and assessment questions, then prepare a short action and evidence checklist.
Key Outcomes
- Identify payment data and basic PCI scope
- Explain merchant and supplier responsibilities
- Recognise core security practices
- Prepare validation questions and an action checklist
Training Mode Physical / Online / Hybrid
HRD Corp Subject to programme eligibility and HRD Corp approval
Level Fundamentals / Beginner. No prior framework knowledge required.
Duration 1 Day | 9:00 AM to 5:00 PM (6.5 learning hours, excluding breaks)
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Group case exercise and a 10-question knowledge check
Certificate Orbix Certificate of Completion upon full attendance; not a professional certification
Malaysia Relevance
Relevant to Malaysian payment, retail, hospitality and e-commerce organisations that store, process or transmit cardholder data or can affect its security. Scope and validation depend on the payment setup and acquiring arrangements.
Practical Takeaways
A payment data-flow worksheet and merchant responsibility checklist.
Download a sample practice worksheet (TXT). This fictional exercise is a preview of the learning approach. About Orbix; contact us to confirm the facilitator and relevant experience for your delivery.
Course Completion and Next Steps
This is independent introductory training. Completion does not award PCI SSC's PCIP or QSA credentials, validate PCI DSS compliance or replace the assessment and validation required by an acquiring bank or card brand.
Frequently Asked Questions
Related Fundamentals Training
Web Application Security (OWASP Top 10) Fundamentals Cloud Security (ISO/IEC 27017) Fundamentals AI Security Controls (CSA AICM) Fundamentals AI Agent Runtime Security (OWASP Agent Control Standard) Fundamentals View all fundamentals programmes
Reference material: PCI SSC: PCI Data Security Standard. PCI SSC: current document library.