Which training content is required for point-of-sale personnel?

Which training content is required for point-of-sale personnel?

• A. Verifying the identity of any third-party persons claiming to be repair or maintenance personnel prior to granting access
• B. Only general customer service training
• C. No training is required
• D. Training focused only on cash handling

Answer: (A)

Training for point-of-sale personnel should cover how to manage access to the POS environment and verify who is allowed to be there. Verifying the identity of any third-party individuals claiming to be repair or maintenance personnel before granting access directly reduces the risk of someone posing as a contractor to reach sensitive systems or cardholder data. This is a concrete, practical security check that supports physical access controls and third-party risk management, which PCI DSS requires as part of security awareness. General customer service training alone does not address access control or protection of payment systems. No training is not acceptable under PCI DSS, since personnel must understand security policies and procedures. Training focused only on cash handling ignores broader security awareness and the need to verify third-party access.

Training for point-of-sale personnel should cover how to manage access to the POS environment and verify who is allowed to be there. Verifying the identity of any third-party individuals claiming to be repair or maintenance personnel before granting access directly reduces the risk of someone posing as a contractor to reach sensitive systems or cardholder data. This is a concrete, practical security check that supports physical access controls and third-party risk management, which PCI DSS requires as part of security awareness.

General customer service training alone does not address access control or protection of payment systems. No training is not acceptable under PCI DSS, since personnel must understand security policies and procedures. Training focused only on cash handling ignores broader security awareness and the need to verify third-party access.