How to Train Every Employee on PCI Security — Even Your Deskless and Non-English-Speaking Staff

If your business accepts card payments, PCI DSS Requirement 12.6 requires you to train every employee who could affect cardholder data security — full-time, part-time, temporary, and contractors — upon hire and at least annually. The hard part for restaurants, retail, hotels, salons, and similar operators is not the content of the training. It is getting that training to hourly, deskless, and non-English-speaking employees who do not have a work email or a computer, and then proving each one of them completed it when an assessor asks.

This guide covers who actually needs the training under 12.6, why deskless and multilingual workforces break traditional security-awareness tools, what the standard actually expects in v4.0, and how to deliver and document the training without an L&D team or an LMS rollout.

Who actually needs PCI security training?

Requirement 12.6 is broader than most operators assume. It is not just the people running the register or processing payments in the back office. It covers all personnel whose actions could affect the security of cardholder data — directly or indirectly:

• Front-of-house staff handling cards. Servers, cashiers, baristas, front-desk clerks, retail associates, stylists who run checkout.
• Back-office staff. Bookkeepers, managers reviewing batches, anyone who can access stored receipts or reports that include card data.
• Support and facilities roles. Cleaners, maintenance, IT contractors, and anyone with physical access to areas where POS terminals or payment devices live.
• Temps and contractors. Seasonal workers, agency staff, contracted cleaners — anyone in the environment falls under the same training expectation.

The cadence is also non-negotiable: training is required upon hire and at least annually thereafter. A onboarding video on day one and silence after that does not meet 12.6.

Why is PCI training so hard for businesses with hourly or deskless staff?

The standard is the same for a 12-table restaurant as it is for a Fortune 500. The reality of delivering it is not. For a typical hourly or deskless workforce, the obstacles stack up fast:

• No work email. Most hourly employees never get a company email address. Security-awareness platforms built around email-based course assignments and reminders simply do not reach them.
• No computer or desk. A server, a cashier, or a housekeeper does not sit at a workstation. Traditional desktop training assumes a chair and a login that does not exist.
• High turnover. Hospitality and retail run double-digit monthly turnover. Onboarding training has to happen on day one, every time, without an IT ticket — and last year’s completion records still need to be intact for the annual refresh.
• Mixed languages. A significant share of restaurant, hotel, and salon staff are more comfortable in Spanish, Vietnamese, Portuguese, Tagalog, or another language. English-only training does not actually train them, and on a PCI assessment that gap is visible.
• No L&D team, no IT department. The owner-operator or the GM is the one rolling training out, between everything else they do.

The honest answer is that off-the-shelf desktop security-awareness tools were designed for office workforces. They are not built for the operators who carry the bulk of card-present commerce.

What does PCI Requirement 12.6 actually expect?

PCI DSS v4.0 sharpened what the training has to look like. The bar is no longer just “everyone watched a generic video once.” The standard expects:

• Security awareness for all personnel. Upon hire and at least annually, covering the threats and policies relevant to their role.
• Content specific to YOUR cardholder data environment. v4.0 expects training tailored to the company’s own cardholder data environment and policies — how you handle card data, the specific procedures your staff are expected to follow. A generic off-the-shelf module on its own is not enough.
• Acknowledgement and comprehension. Personnel are expected to acknowledge they have read and understood the security policy and procedures. Knowledge checks that prove comprehension are stronger than a signature on a sheet.
• Documentation. Per-employee records — who took which training, on what date — that can be produced for an assessor.

Lasso Learn is not a QSA and does not certify PCI compliance. PCI compliance is broader than training, and your assessor or acquirer makes the compliance determination. What we do is the delivery, customization, multilingual narration, and tracking that helps an operator actually meet the 12.6 training mandate.

How do you train and DOCUMENT it for an assessment?

The two pieces an assessor wants to see are that the training happened and what it covered — for every person in scope. A done-for-you mobile model produces both as a side effect of how it is rolled out:

• Per-employee completion records. Every completion is tied to an individual employee, with a timestamp and the version of the course completed.
• Knowledge checks. Short comprehension questions after each section produce a real record that the employee understood the content — not just that they pressed play.
• Certificates of completion. A per-employee, per-course certificate is generated automatically. These are internal certificates of completion for your training; they are not PCI certifications.
• Audit-ready export. A single export gives an assessor the roster, the dates, the courses, and the comprehension results — instead of a stack of signed sheets pulled from a drawer.
• QR / PIN login for deskless workers. A QR badge or a company code plus personal PIN gets a hostess, a line cook, or a housekeeper into the training on their own phone or a shared break-room tablet, with completions still attributed to the individual.
• Mixed-language delivery. The same module narrated in Spanish, Vietnamese, Portuguese, or another language so every employee actually learns the material in the language they understand best — and the dashboard still rolls up across all of them.

How is this different from off-the-shelf security awareness software?

Off-the-shelf security-awareness libraries — including phishing-simulation tools — are built for office workforces with email and desktops. They do useful things in that environment. For a hospitality or retail operator with hourly, deskless, multilingual staff, they leave the most exposed part of the workforce untrained. The two models can complement each other, but they are not the same thing:

An office with desktop staff often runs an awareness library and custom training for its frontline. The two cover different populations. The point is not to replace one with the other — it is to stop assuming the desktop tool reaches the part of the workforce most often exposed to card data.

How fast can it be ready?

Done-for-you means the work the operator does is short. You send your security policy and procedures — what you already have for PCI — plus any short phone videos of how staff are expected to handle cards, terminals, or receipts. The partner builds the course:

• Days to a first module. A core PCI security awareness module built from your policy, narrated, with comprehension checks, lands as a draft in days.
• Weeks for the full rollout. Role-specific modules (front-of-house, back-office, contractors), the multilingual versions, and the assignment-and-tracking setup come together over weeks, not months.
• No L&D team. No LMS implementation. The course and the tracking come together. You do not separately license an LMS, buy a library, and stitch them together.
• Annual refresh handled. When the year rolls around, the refresher re-assigns automatically and the dashboard shows who is current and who is overdue — for the same set of people you were already tracking.

Frequently Asked Questions

Does this make us PCI compliant?

No. PCI compliance is broader than training and Lasso Learn is not a QSA. Your assessor or acquirer makes the compliance determination. What we do is help you meet the training portion — Requirement 12.6 — by delivering customized training to every employee, including deskless and non-English-speaking staff, and producing the per-employee documentation an assessment expects.

Do you issue a PCI certification?

No. The certificate generated at the end of each course is an internal certificate of completion for your training program — useful for your documentation and for your assessor’s evidence file. It is not an official PCI certification, and we do not represent it as one.

Can the training be in Spanish, Vietnamese, or other languages?

Yes. The same module can be delivered with native-language narration so every employee learns the material in the language they understand best. The dashboard still rolls up across all languages, so you have one consolidated record for the entire workforce.

How often does each employee need this training?

Per Requirement 12.6, security awareness training is required upon hire and at least annually thereafter, for all personnel whose actions could affect cardholder data security. The platform handles the assign-on-hire and annual-refresher cadence automatically and shows you who is current at any moment.