Never connect unauthorized devices (USBs, phones, hotspots) to the organization's network.
Use only approved network connections (wired or wireless) provided by IT.
Immediately report any suspicious pop-ups, network latency, or unusual activity to IT/security.
Awareness Focus: "Unsecure devices and poor segmentation can open the door for cyber intrusions. All users are part of the network's first line of defense."
- Do not alter security configurations or default settings on company-issued systems
- Never disable security features like antivirus, firewalls, or screen locks
- Enforce baseline hardening standards (e.g., CIS benchmarks) for all systems
- Approve and review secure configurations for every system and device used in cardholder data environments
Awareness Focus: "Default settings are hacker-friendly. Secure configuration starts at the top and is protected by every user's discipline."
Never save cardholder data (CHD) or sensitive authentication data (SAD) locally or on unauthorized systems.
Avoid emailing or taking screenshots of payment data.
Use only approved applications or systems when handling payment data.
Awareness Focus: "Cardholder data must be treated like gold — valuable, risky, and never to be stored carelessly."
Only use approved systems for data transmission
Never send CHD via email or messaging apps
Report any accidental insecure transmissions
Management must ensure TLS 1.2+ is implemented for all in-scope systems and validate certificates, keys, and encryption methods annually. Remember: "A weak link during transmission can be exploited mid-air. Encryption is your digital armor."
Never install unapproved software or plugins
Don't click links or download attachments from unknown senders
Run antivirus scans if applicable to your role
Management is responsible for deploying centrally managed antivirus systems and regularly updating definitions. Remember that "Malware doesn't knock — it sneaks in. Vigilance and behavior are just as important as technology."
Apply patches and updates as instructed by IT without delay
Don't develop or use self-created tools without approval
Cooperate with security testing when assigned
Management must implement a secure software development lifecycle (SDLC) and ensure code reviews, vulnerability scans, and change control are in place. "Every update counts. Secure development isn't a phase—it's a commitment."
Use only the systems and data you are authorized to access
Never share accounts with colleagues
Don't attempt to access restricted files or databases
Management enforces access controls based on job needs
Awareness Focus: "Least privilege means just enough access to do your job—nothing more, nothing less."
Use strong, unique passwords or passphrases
Keep login information private
Enable multi-factor authentication where required
Never leave logged-in sessions unattended
Management must ensure secure authentication methods are enforced across systems and conduct periodic reviews of user accounts. Remember: "Your password is your personal key. Never lend it. Never duplicate it. Always secure it."
Do not allow unauthorized individuals to follow you into secure areas. Each person should use their own credentials to access restricted zones.
Keep identification visible at all times and report lost or stolen badges immediately to security personnel.
Lock laptops with security cables when unattended and properly store or shred printed documents containing sensitive information.
Management is responsible for implementing visitor controls, CCTV, door access systems, and facility zoning. "Digital security begins with physical integrity. Control the space; protect the data."
All system access is recorded
Systems are always watched
Never disable logging tools
End users should never attempt to disable system logs or tamper with monitoring tools. Be aware that all access is logged and monitored for security and compliance. Report any unusual system behaviors or access attempts immediately. "Transparency is security. The logs tell a story — make sure it's the right one."
End users must cooperate during security testing activities and never attempt to bypass or interfere with these processes. Management must schedule regular testing and act promptly on discovered vulnerabilities. "Testing reveals the cracks before attackers do. It's prevention, not paranoia."
Familiarize yourself with all information security and acceptable use policies.
Participate in all PCI DSS and security awareness training sessions.
Immediately report suspected breaches or policy violations.
Awareness Focus: "Security is everyone's responsibility. Culture, policy, and leadership turn awareness into action."
Remember these critical points: Cardholder data must be handled with care, always. Security policies are mandatory, not optional. Be alert for phishing, social engineering, and suspicious behavior. If you see something, say something—reporting early prevents disasters. Compliance is not a checkbox; it's a mindset.
Top management must visibly support and prioritize PCI DSS compliance through actions, communications, and resource allocation.
Ensure adequate funding and staffing for secure technologies, comprehensive training programs, and effective monitoring systems.
Foster a security-first culture where risk assessment and mitigation are integrated into all business processes and decisions.
Lead policy enforcement, incident response preparation, and continuous improvement of security practices.
"Top Management must lead with security. Their actions define the seriousness with which the organization treats its data protection responsibilities."
Protecting customer confidence through robust security
Ensuring payment data remains secure
Maintaining the integrity of payment ecosystems
Success through collaboration at all levels
"PCI DSS v4.0.1 is more than a compliance standard—it is a blueprint for safeguarding trust, protecting customers, and securing the digital heartbeat of every payment ecosystem. Success lies in shared responsibility, strong leadership, and daily security awareness at every level of the organization."
By clicking submit button, I confirm that I have read, understood, and will follow the information security and privacy responsibilities outlined in this guide, and will promptly report any security concerns.
NUK 9 Information Security Auditors LLP [NUK 9 Auditors]
E702, Arjun, NL Complex, Anand Nagar, Dahisar East
Mumbai, Maharashtra - 400068. India
This material, including all content, graphics, systems, and tools referenced or used herein, is the intellectual property of NUK 9 Auditors. Unauthorized copying, distribution, modification, or use of this material or related systems is strictly prohibited and may result in disciplinary or legal action.
Use of content is permitted only for internal team, it's contracted services and authorized purposes in accordance with company policies.
Professional Awareness Notes Covering Requirements 1–12