Security training frequency should be:

Security training frequency should be:

• A. Every six months
• B. Annually
• C. Every two years
• D. Never

Answer: (B)

Regular security awareness training should occur at least annually to keep employees up to date on threats, policies, and safe practices. This minimum cadence aligns with PCI DSS guidance for a formal security awareness program, ensuring staff refresh their knowledge as new threats emerge and phishing or social engineering attempts evolve. More frequent training, like every six months, isn’t required by the standard and may be unnecessary for some environments, while training every two years or never creates gaps attackers can exploit. So, annual training is the appropriate default.

Regular security awareness training should occur at least annually to keep employees up to date on threats, policies, and safe practices. This minimum cadence aligns with PCI DSS guidance for a formal security awareness program, ensuring staff refresh their knowledge as new threats emerge and phishing or social engineering attempts evolve. More frequent training, like every six months, isn’t required by the standard and may be unnecessary for some environments, while training every two years or never creates gaps attackers can exploit. So, annual training is the appropriate default.