PCI Forensic Investigator Training
In the event of an actual or suspected attack, compromise or vulnerability affecting payment card transactions or cardholder data a forensic investigation may be required. Forensic investigation of credit card data can be challenging and complex, requiring forensic investigators with highly specialized skills and proven staff and experience, capable of rapid response.
Prior to the PFI Program, Participating Payment Brands maintained separate requirements for forensic investigators for such events, and the process of selecting or being qualified as an investigator could be complicated and cumbersome, especially when the Security Issue in question affected multiple Participating Payment Brands.
In an effort to help ensure that each PFI Company and PFI Employee possesses the requisite knowledge, skills, experience and capacity to perform PFI Investigations in a proficient manner in accordance with industry expectations, each PFI Company and each PFI is required at all times to satisfy all applicable PFI Qualification Requirements, including PCI SSC required training.
Course Highlights
PCI Forensic Investigator (PFI) training is a two-part program. The first is a seven-hour prerequisite course and exam about PCI Fundamentals. It’s followed by an in-depth course that can be taken via online eLearning format and exam.
Part 1 – PCI Fundamentals
PCI Fundamentals assures that all candidates taking the PFI training course have the same baseline understanding. The PCI Fundamentals course must be completed within thirty days of initial access. This prerequisite course covers:
- Understanding the Payment Card Industry Security Standards Council and its role
- Defining the processes involved in card processing
- PCI roles and responsibilities
- Understanding cardholder data
- Defining network segmentation
- PCI DSS assessments
Part 2 – PFI Training
Candidates who successfully complete the prerequisite PCI Fundamentals course may move on to the PFI qualification course. This course builds on the knowledge gained in PCI Fundamentals and delves into the actual PCI DSS requirements, brand reporting, compliance reports and more. The PCI Forensic Investigator course covers:- What is PCI and what does it mean to companies that must meet compliance with the DSS?
- Industry overview
- Terminology
- Transaction data flow
- Relationships between various organizations in the process
- How the credit card brands differ in their validation and reporting requirements
- PCI Data Security Standard (DSS)
- Overview of each requirement
- Testing procedures
- What constitutes compliance
- PCI Hardware and Communications Infrastructure
- PCI Forensic Reporting
- Overview of compliance issues and mitigation strategies
- Compensating controls
- Creating policies
- Modifying cardholder data environment
Right for You?
If you have experience in any of these areas and are an approved Qualified Security Assessor (QSA), consider the PFI Qualification:
- Security/Technology
- Compliance/ Risk/ Governance
- e-Commerce
Digital Badging
When you become a PCI Forensic Investigator, display your digital badge and represent your skills and gives you a way to share your abilities online in a way that is simple, trusted and can be easily verified in real time.
Prices
| Course | Price | |
New PFI Training |
$1,650 USD | |
Requalification PFI Training |
$1,100 USD |
Please note: Unless otherwise specified, all fees are in US Dollars. An invoice will be issued upon completion of registration and will include instructions to pay by check, credit card or wire transfer.
Payment is required prior to beginning the course. Course conducted in English. Examination delivered in English.
Training Formats and Exam Information
New Training Offerings:
This training will include a 8-hour online prerequisite Fundamentals course followed by a 60 multiple choice question exam with a 75-minute time limit. Three attempts to pass Fundamentals will be allowed. Once the Fundamentals exam is passed, you will gain access to an 8-hour online main PFI Course.
- eLearning: Self-paced computer-based training (CBT). You will have 90 days from the receipt of payment to complete all components of the training and the exam. The exam will be delivered via Pearson Vue.
New Exam Specifics:
- All exams are closed book.
- Exam is 75 multiple choice questions with a 90-minute time limit.
- Results of Pearson Vue exams are delivered upon completion of the exam.
- 75% or higher to pass the exam; the only information that can be released concerning exams is your grade.
- If you fail the exam, you are allowed one retake (within 30 days of failure notice) for a fee.
Registration Process
Candidates for PFI qualification must currently work for an active and approved PFI Company that is listed on the PCI website and meet all qualifications outlined in section 3.3 of the PFI Program Qualification Requirements.
Step 1 – Review
Refer to the PFI Qualification Requirements for complete program description and requirements and to confirm that you are well suited for the program.
Next, discuss your eligibility with your firms primary contact:
- The Primary Contact can log into the PCI portal and complete the registration enrollment online (See step 2)
Step 2 – Apply
- Submit PFI registration form
- Once we receive your registration, we will notify you once we have enrolled you in the course.
- Applicants will be notified via email of their application status within 4 days of submitting their fully completed application.
- Following the approval of application, a training invoice will be emailed within 2-3 business days
- Submit payment
Step 3 - Train
Upon receipt of payment, you will:
- You will receive a link to access the eLearning course.
- You will have 90 days from the day you receive the link to complete the course and take the exam.
- You will also receive a separate email from Pearson VUE with credentials and complete instructions on how to schedule your exam
Step 4 - Activate
Pass/Fail results are provided immediately following the conclusion of the exam.
Passing candidates will receive a Certificate of Qualification via email and will be added to the Council’s website listing of PCI Forensic Professionals (PFI).
Requalification Requirements
In order to maintain the high standards, set for this qualification, all PFIs must requalify annually to continue to maintain their status and be listed on the PCI website.
Requalification requirements help ensure that PFIs remain current with technical and industry changes and demonstrate professionalism. To maintain active qualification status, PFIs must:
- Maintain all incident response certifications
- Achieve a passing score on the PFI requalification exam (or maintain QSA employee qualification)
Requalification Process
The Council emails courtesy reminders 90 days in advance of your qualification expiry date. To complete the requalification process:
For PFI Requalification only;
- PFI Primary contact logs into portal and assigns PFI to PFI Requalification training session
- Requalification registration must be submitted prior to the expiry date and a passing score must be achieved on the exam no later than 14 days after the expiry date
- CPEs are not required to maintain the PFI only qualification
- An invoice will be emailed within 2-3 business days
- You will receive an email containing instructions and credentials to complete the requalification exam within 2 business days of payment processing
- Once you successfully pass the exam, a new certificate will be emailed and you’ll be listed on the PCI website as a PCI Forensic Investigator (PFI) for the following year
For QSA and PFI Requalification;
-
The required requalification registration must be submitted to your Primary prior to the expiry date and a passing score must be achieved on the exam no later than 14 days after the expiry date.
- An invoice will be emailed within 2-3 business days
- You will receive an email containing instructions and credentials to complete the requalification exam within 2 business days of payment processing
Once you successfully pass the exam, a new certificate will be emailed and you’ll be listed on the PCI website as a PCI Forensic Investigator (PFI) for the following year
