PCI DSS v4.0 requirement 6.2.2 says people who develop bespoke and custom software must be trained at least once every 12 months, in security relevant to their job function and development languages. Keep records of who was trained, on what, and when.
What the requirement says
Based on a published summary of the requirement, training must cover secure software design and secure coding techniques, and, if security testing tools are used, how to use them to detect vulnerabilities. The same summary says training should also cover methods for finding vulnerabilities in code and processes that stop previously fixed vulnerabilities from returning, and that developers should understand the attack categories listed in requirement 6.2.4, such as injection, business logic, cryptography and access control attacks. Check the exact wording against the current standard text from the PCI Security Standards Council before you build an evidence plan, since this article relies on a secondary summary.
What "role relevant" means in practice
A front-end developer needs output encoding and client-side issues. A backend developer needs injection and authorization. Someone writing infrastructure code needs secrets handling and least privilege. One generic video for everyone fits the letter of an annual tick, but not the spirit of the requirement.
Match content to the languages your team really uses. Hands-on labs in those languages double as proof that the training was specific.
Evidence assessors usually ask for
The summary notes that organizations must keep records of who was trained and when, and that assessors verify by reviewing those records and interviewing personnel. A practical evidence set:
- A roster of in-scope developers, with start dates
- Training dates, titles and duration per person
- The syllabus or lab list, mapped to languages and roles
- Completion records or lab results
- A rule for new joiners, such as completing training within a set number of days of starting
Interviews matter too. Be ready for an assessor to ask a developer what they learned and how they apply it.
Build the program around labs
Short workshops with labs, such as a 90-minute secure coding workshop, give you attendance records, lab artifacts and a syllabus. A CTF day can add practice on testing tools. Schedule a refresher well before the 12-month point, so that nobody lapses while on leave.
Common gaps
- Contractors who write code but are not on the roster
- Training that ignores the languages in use
- No record linking each person to a date
- Annual training that nobody connects to real findings
Compliance tooling can track evidence collection, though the content still has to come from you.
Quick check
Does an annual video satisfy 6.2.2?
It depends on content and relevance to job function and languages. Confirm with your assessor, and prefer role-specific, hands-on material.
Sources
Last reviewed: 19 October 2026.
