The Internal Security Assessor program teaches you how to perform internal assessments for your company and recommend solutions to remediate issues related to PCI DSS compliance. Assessors are sponsored by their companies, so when you receive this qualification you will be able to act as a liaison with external PCI auditors and manage interactions with a Qualified Security Assessor (QSA).
Benefits of the course include:
You are an experienced internal auditor, or an internal security or risk assessment professional at a retailer, institution, acquiring bank or processor.
“The instructor did an excellent job, I highly recommend him for all future trainings.”
“Loved the training. I learned a lot and made many notes on what I need to do for 2013 SAQ.”
“PCI isn't the most exciting or entertaining material. With the instructor's humor and real world experience, learning PCI and how to be an ISA was a good experience.”
In addition to an eLearning format available 24/7, the Council also offers scheduled two-day instructor-led classes. Our authorized PCI Global Training Network (PGTN) provider will also hold instructor-led classes in various locations worldwide. See schedules below.
If you have a group to train, please consider our Corporate Group Training instructor-led option, where an expert PCI instructor comes to your facility (or any location you choose) to deliver the course. We offer volume discounts - the more you train, the more you save! Please click below to learn more, or contact us now for a custom quote.Learn More Contact Us
Internal Security Assessor (ISA) training is a two-part program. The first is a seven-hour prerequisite course and exam about PCI Fundamentals. It’s followed by an in-depth course (that can be taken via either instructor-led or online eLearning format) and exam.
PCI Fundamentals assures that all candidates attending the ISA training course have the same baseline understanding. The PCI Fundamentals course must be completed within thirty days of initial access and a minimum of one week prior to the start of an on-site training class. This prerequisite course covers:
Candidates who successfully complete the prerequisite PCI Fundamentals course may move on to the ISA qualification course. This course builds on the knowledge gained in PCI Fundamentals and delves into the actual PCI DSS requirements, testing procedures, compliance reports and more. The Internal Security Assessor course covers:
The instructor-led course includes case studies providing a simulation of assessment scenarios that may help you in solving common problems within your own payment environment.
Prior to beginning the PCI Fundamentals training, you should familiarize yourself with these publications on the PCI website:
The online prerequisite course concludes with a 50 question multiple-choice exam. Once the candidate has completed the PCI Fundamentals training and exam, the Primary Contact will be notified of either a passing or failing grade. If the candidate failed the exam, he or she will be allowed two additional attempts to take and pass without being charged an additional fee.
Depending on which format the candidate is registered for, the following will transpire:
Once the candidate passes the exam, the candidate's seat will be confirmed for training and a confirmation email will be sent to the Primary Contact with complete location details. As an ISA candidate, your seat is not confirmed until your Primary Contact receives a confirmation email.
Once the candidate passes the exam, the candidate will receive a link to the online training course.
This two-day classroom instruction provides:
Attendance during the entire two day course is mandatory. Missing more than 30 minutes of the class will automatically result in forfeiture of the PCI SSC ISA exam and removal from the class.
Taking the exam - The certification exam is given immediately following the instructor-led course. The only document you will be allowed to reference during the testing is a translation dictionary, if needed. No electronic devices may be used during the exam. This is a closed book exam. The exam consists of 75 multiple choice questions and you will have 90 minutes to complete it.
The Primary Contact at the Sponsor Company will be notified of results within two weeks after the ISA candidate attends the instructor-led PCI SSC ISA training and exam. Candidates who fail this exam may pay $250 and retake the exam at a Pearson VUE Testing Center within 30 days of failing status notification. Candidates who wish to enroll in a second class will be required to pay the full costs for the chosen location and will be required to retake and pass PCI Fundamentals. If the candidate passes, the Sponsor Company will be sent a certificate that validates the candidate's active ISA status for the next 12 months
Instructor-Led Training is also provided by PGTN Providers in certain regions; candidates attending a PGTN class will take the exam at an authorized Pearson Vue Testing Center. Refer to the elearning section below for taking the exam.
This self-paced online eLearning course offers:
Taking the exam - Upon completion of the eLearning curriculum, the student will take the qualification exam at one of over 4,000 Pearson VUE Testing Centers worldwide. The student will receive a voucher number to be redeemed in Pearson VUE's online registration system; testing location and time are selected by the student. The exam must be completed in one sitting and must be taken within 30 days of the candidate being given the information on how to schedule the exam.
Candidates who fail this exam may pay $250 and retake the exam at a Pearson VUE Testing Center within 30 days of failing status notification. If the candidate fails the second exam, he/she is required to pay for and retake the entire course, including PCI Fundamentals, in either instructor-led or eLearning format.Find a Testing Center Request More Information
Registrants must have significant relevant security audit and assessment experience (including but not limited to Network Security, Application Security and Consultancy, System Integration, and Auditing). A minimum of five years experience is recommended.
Complete and Submit an Application
ISA training candidates must be sponsored by their employer.
If your company is already an ISA sponsor, please request that your Primary Contact submit a training registration on your behalf through the ISA Portal.
If your company is not already an ISA sponsor, please refer to the ISA Qualification Requirements for a complete program description and requirements, and to confirm that both you and your organization are well suited for the program. Then follow the steps below:
In order to maintain the high standards set for this certification, all ISA employees must re-certify every 12 months in order to continue as an Internal Security Assessor for their Sponsor Company. All ISA Program training attendees will be required to sign and accept the terms of the PCI SSC ISA Employee Certification form at the time they begin the online training.
All training inquiries and assignments must be submitted through the ISA Sponsor Company's primary contact. Primary Contacts will submit training requests via the ISA Portal. PCI SSC requires all ISA trainees to be full time employees of the company that sponsors their ISA training. Once certified, if an ISA professional leaves their sponsoring company, they must complete new certification sponsored by their new employer.
All requests for requalification must be submitted at least two weeks prior to the certificate expiration date. Attempting to recertify two weeks or more after the ISA’s annual expiration date will require the ISA to attend New ISA training.
*Note: Payment of the training invoice must be received before login information will be sent to the candidate.
It is recommended that the ISA candidate have information systems assessment training within the last 12 months to support professional certifications of a minimum 20 Continuing Professional Education (CPE) hours per year and 120 Continuing Professional Education (CPE) hours over a rolling three year period.
To register, please have your company’s primary contact log into the portal to submit the request. Primary contacts, please submit questions to the ISA Program Manager at email@example.com