PCI Security Standards Council®

Internal Security Assessor (ISA)™ Qualification

The Internal Security Assessor program teaches you how to perform internal assessments for your company and recommend solutions to remediate issues related to PCI DSS compliance. Assessors are sponsored by their companies, so when you receive this qualification you will be able to act as a liaison with external PCI auditors and manage interactions with a Qualified Security Assessor (QSA).
 

Registration Process

Registrants must have significant relevant security audit and assessment experience (including but not limited to Network Security, Application Security and Consultancy, System Integration, and Auditing).  A minimum of five years experience is recommended.

Complete and Submit an Application

ISA training candidates must be sponsored by their employer.

If your company is already an ISA sponsor, please request that your Primary Contact submit a training registration on your behalf through the ISA Portal.

If your company is not already an ISA sponsor, please refer to the ISA Qualification Requirements for a complete program description and requirements, and to confirm that both you and your organization are well suited for the program. Then follow the steps below:

  1. Submit ISA registration form
  2. Complete company application (Primary Contact will gain access to the online application on  the PCI SSC secure portal only after the ISA registration form has been approved).
  3. Enroll professionals in ISA training (Primary Contact will have the ability to enroll professionals in ISA training through the portal only after the ISA Company application has been approved).
  4. Submit payment (training invoice will be emailed to Primary Contact within 2-3 business days of ISA training request approval). For more information about the training fees, please see the ISA Training Pricing page.

Course Details

Benefits of the course include:

  • Understand the PCI DSS and how it can help protect your customer data and your business
  • Define the processes involved in card processing and network segmentation
  • Help your organization build internal expertise and assess its compliance with PCI Standards
  • Enhance payment card data security and manage compliance costs
Training Overview

Internal Security Assessor (ISA) training is a two-part program. The first is a seven-hour prerequisite course and exam about PCI Fundamentals. It’s followed by an in-depth course (that can be taken via either instructor-led or online eLearning format) and exam.

Part 1 - PCI Fundamentals

PCI Fundamentals assures that all candidates attending the ISA training course have the same baseline understanding. The PCI Fundamentals course must be completed within thirty days of initial access and a minimum of one week prior to the start of an on-site training class. This prerequisite course covers:

  • Understanding the Payment Card Industry Security Standards Council and its role
  • Defining the processes involved in card processing
  • PCI roles and responsibilities
  • Understanding cardholder data
  • Defining network segmentation
  • PCI DSS assessments

Part 2 - ISA Qualification

Candidates who successfully complete the prerequisite PCI Fundamentals course may move on to the ISA qualification course. This course builds on the knowledge gained in PCI Fundamentals and delves into the actual PCI DSS requirements, testing procedures, compliance reports and more. The Internal Security Assessor course covers:

  • What is PCI and what does it mean to companies that must meet compliance with the DSS?
    • Industry overview
    • Terminology
    • Transaction data flow
    • Relationships between various organizations in the process
  • How the credit card brands differ in their validation and reporting requirements
  • PCI Data Security Standard (DSS)
    • Overview of each requirement
    • Testing procedures
    • What constitutes compliance
  • PCI Hardware and Communications Infrastructure
  • PCI Reporting
  • Overview of compliance issues and mitigation strategies
  • Compensating controls
  • Creating policies
  • Modifying cardholder data environment

The instructor-led course includes case studies providing a simulation of assessment scenarios that may help you in solving common problems within your own payment environment.

Training and Exam

PCI Fundamentals

The online prerequisite course concludes with a 60 question multiple-choice exam. Once the candidate has completed the PCI Fundamentals training and exam, the Primary Contact will be notified of either a passing or failing grade. If the candidate failed the exam, he or she will be allowed two additional attempts to take and pass without being charged an additional fee.*

*If the candidate receives a failing grade for the PCI Fundamentals course after the third attempt, his or her seat at the instructor-led session will be forfeited. If he or she wishes to try again, the candidate will be required to pay the full course fee for a second time and receive a passing grade in the PCI Fundamentals course to be allowed to attend the two-day instructor-led session. There will be no exceptions made and by paying the invoice, you agree to these terms.

Instructor-Led ISA Qualification Course

This two-day classroom instruction provides:

  • In-person engagement and collaboration as well as networking opportunities
  • Ability to focus on curriculum in classroom setting
  • Learn directly from an expert PCI SSC trainer with hands-on experience assessing merchants and/or service providers

Taking the exam - The certification exam is given immediately following the instructor-led course. The only document you will be allowed to reference during the testing is a translation dictionary, if needed.  No electronic devices may be used during the exam. This is a closed book exam. The exam consists of 75 multiple choice questions. You will have 90 minutes to complete it.

The Primary Contact at the Sponsor Company will be notified of results within two weeks after the ISA candidate attends the instructor-led PCI SSC ISA training and exam. Candidates who fail this exam may pay $165 and retake the exam at a Pearson VUE Testing Center within 30 days of failing status notification. Candidates who wish to enroll in a second class will be required to pay the full costs for the chosen location and will be required to retake and pass PCI Fundamentals. If the candidate passes, the Sponsor Company will be sent a certificate that validates the candidate's active ISA status for the next 12 months.

eLearning ISA Qualification Course

This self-paced online eLearning course offers:

  • Flexible scheduling 24/7/365
  • Learn from your home or office
  • Reduced travel costs and time away from work

Taking the exam - Upon completion of the eLearning curriculum, the student will take the qualification exam at one of over 4,000 Pearson VUE Testing Centers worldwide. The student will receive a voucher number to be redeemed in Pearson VUE's online registration system; testing location and time are selected by the student. The exam must be completed in one sitting and must be taken within 90 days of the candidate being given the information on how to schedule the exam.

Candidates who fail this exam may pay $165 and retake the exam at a Pearson VUE Testing Center within 30 days of failing status notification. If the candidate fails the second exam, he/she is required to pay for and retake the entire course, including PCI Fundamentals, in either instructor-led or eLearning format.

Find a Testing Center


Group Training

If you have a group to train, please consider our Corporate Group Training instructor-led option, where an expert PCI instructor comes to your facility (or any location you choose) to deliver the course. We offer volume discounts - the more you train, the more you save! Please click below to learn more, or contact us now for a custom quote.

Learn More Contact Us

How to Prepare

Prior to beginning the PCI Fundamentals training, you should familiarize yourself with these publications on the PCI website:

  • PCI Glossary
  • PCI DSS
  • PCI DSS Self-Assessment Questionnaire (SAQ)

ISA 2022 Classes

Remote Training

Classes are a combination of eLearning and a live webinar.

In person Training

By registering for in-person training, you agree that during and in connection with the training event, you will comply with all applicable COVID-19 requirements, best practices and recommendations of the Centers for Disease Control and Prevention (CDC), state, regional and local governments, the training event venue or hotel, and PCI SSC ("Requirements"). Details about the Requirements will be shared with participants as we approach the training event date.

Webinar or In person training dates are listed below.

Date
Time
Remote or
In person Location
Non Participation Organization
Date:7 Jul
CLOSED
Time: 09:00-17:30 (EST)
Remote or In person Location: Remote
Non Participation Organization: $3,100 USD
CLOSED
Participating Organization**: $1,800 USD
CLOSED
Date:26 - 27 Jul
Time: 09:00-17:30
Remoter or In person Location: Mexico: Hosted by 1stSecureIT (dba GM Sectec)
Non Participation Organization: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Participating Organization**: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Date:1-2 Aug
Time: 09:00-17:30
This Class will be conducted in English
Remoter or In person Location: Miami: Hosted by 1stSecureIT (dba GM Sectec)
Non Participation Organization: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Participating Organization**: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Date:3-4 Aug
Time: 09:00-17:30
This Class will be conducted in Spanish
Remoter or In person Location: Miami: Hosted by 1stSecureIT (dba GM Sectec)
Non Participation Organization: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Participating Organization**: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Date:8-9 Sep
Time: 09:00-17:30
Remote or In person Location: Toronto
Non Participation Organization: $3,100 USD*
Participating Organization**: $1,800 USD*
Date:21 Sep
Time: 08:00-16:00 (JST)
This class will have Japanese translation
Remote or In person Location: Remote
Non Participation Organization: $3,100 USD
Participating Organization**: $1,800 USD
Date:4 - 5 Oct
Time: 09:00-17:30
This Class will be conducted in Spanish
Remoter or In person Location: Chile: Hosted by 1stSecureIT (dba GM Sectec)
Non Participation Organization: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Participating Organization**: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Date:13-14 Oct
Time: 09:00-17:30
Remote or In person Location: Milan
Non Participation Organization: $3,100 USD*
Participating Organization**: $1,800 USD*
Date:24-25 Oct
Time: 09:00-17:30
This Class will be conducted in Spanish
Remoter or In person Location: Barcelona: Hosted by 1stSecureIT (dba GM Sectec) and A2 Secure
Non Participation Organization: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Participating Organization**: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Date:14-15 Nov
Time: 09:00-17:30
This Class will be conducted in Spanish
Remoter or In person Location: Colombia: Hosted by 1stSecureIT (dba GM Sectec)
Non Participation Organization: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Participating Organization**: For Pricing, please contact Ruth Lares at ruth.lares@gmsectec.com
Date:13 Dec
Time: 09:00-17:30 (EST)
Remote or In person Location: Remote
Non Participation Organization: $3,100 USD
Participating Organization**: $1,800 USD
Please note: All fees are NON-REFUNDABLE and NON-TRANSFERABLE. Unless otherwise specified the training and exam will be delivered in English.

Price does not include any applicable VAT/HST/GST which will appear on your invoice.

* Not including VAT

**Become a Participating Organization and SAVE up to 40% on ISA training fees. To learn about becoming a Participating Organization please click here.
Apply Now Request More Information

Requalification Requirements

In order to maintain the high standards set for this certification, all ISA employees must re-certify every 12 months in order to continue as an Internal Security Assessor for their Sponsor Company. All ISA Program training attendees will be required to sign and accept the terms of the PCI SSC ISA Employee Certification form at the time they begin the online training.

All training inquiries and assignments must be submitted through the ISA Sponsor Company's Primary Contact. Primary Contacts will submit training requests via the ISA Portal. PCI SSC requires all ISA trainees to be full time employees of the company that sponsors their ISA training. Once certified, if an ISA professional leaves their sponsoring company, they must complete new certification sponsored by their new employer.

All requests for requalification must be submitted at least two weeks prior to the certificate expiration date. Attempting to recertify two weeks or more after the ISA’s annual expiration date will require the ISA to attend New ISA training.

To register, please have your company’s primary contact log into the portal to submit the request. Primary contacts, please submit questions to the ISA Program Manager at isa@pcisecuritystandards.org

*Note: Payment of the training invoice must be received before login information will be sent to the candidate.

Right for you?

You are an experienced internal auditor, or an internal security or risk assessment professional at a retailer, institution, acquiring bank or processor.

Our website uses both essential and non-essential cookies (further described in our Privacy Policy) to analyze use of our products and services. By clicking “ACCEPT” below, you are agreeing to our use of non-essential cookies to provide third parties with information about your usage and activities. If you click “DECLINE” below, we will continue to use essential cookies for the operation of the website.