Many people who work with PCI DSS every day are not assessors, and the PCI Professional (PCIP) qualification is the PCI Security Standards Council's credential for them. It is an individual, portable qualification that proves working knowledge of PCI DSS and the payment ecosystem, without the employer sponsorship that the Internal Security Assessor (ISA) and Qualified Security Assessor (QSA) routes require. This guide sets out what PCI SSC publishes about the PCIP: who it is aimed at, the training formats, the exam, fees, the three-year requalification cycle and continuing education, then adds a preparation plan and a clear view of what a PCIP can and cannot do compared with an ISA or QSA. It is for compliance managers, security engineers, finance and e-commerce staff, consultants and product teams who handle PCI DSS work, and for managers deciding whether to fund it.
This is an independent guide from NHI Mgmt Group, based on PCI SSC's public documentation as of November 2026. It is not sponsored or reviewed by PCI SSC. Programme rules and fees change, so confirm details against PCI SSC's current pages before enrolling.
Key takeaways
- It belongs to you, not your employer. PCI SSC states the PCIP is not affected by changes in employment and stays in effect while you meet the programme requirements, unlike the ISA and QSA, which end when the sponsoring employment ends.
- It is a knowledge credential, not an assessor licence. PCIP status does not carry the rights of other PCI SSC qualifications; a PCIP cannot prepare a Report on Compliance (ROC), while an ISA can where the card brands and acquirer allow it.
- The exam is short and closed book. The current exam is 75 multiple-choice questions in 90 minutes with a 75% pass mark, taken through Pearson, after a six-hour online prerequisite course.
- Renewal is every three years, with yearly CPE. You need 10 CPE hours each year and 30 over a rolling three-year period, plus a requalification exam, and you must follow the PCI SSC Code of Professional Responsibility.
- Fees rise on 1 January 2027. New training and exam for a non-Participating Organisation candidate is listed at $2,750, rising to $3,000; Participating Organisation members pay less, and ISAs and QSAs can opt in without the exam.
Who the certification is for
PCI SSC describes the PCIP as an entry-level certification in payment security information and a renewable career certification. The course description names the audience: people in information security and technology, finance or e-commerce roles in the payments value chain, and staff in product development, marketing or sales of payment products. Example titles it lists include IT Manager, IT Security Manager, Compliance Manager, Governance and Risk Manager, Financial Crime and Fraud Manager, E-Commerce Manager, Product Development Engineer, Project Manager and Independent Consultant.
| Aspect | PCIP | ISA | QSA |
|---|---|---|---|
| Purpose | Demonstrate knowledge of PCI DSS and the payment ecosystem | Assess the sponsoring company's own PCI DSS compliance | Perform independent PCI DSS assessments for clients |
| Sponsor needed | No | Yes, the employing merchant or service provider | Yes, full-time employment with a QSA company |
| Portability | Stays with the individual | Ends if employment with the sponsor ends | Tied to the QSA company |
| Can prepare a ROC | No | Depending on card brand and acquirer programmes | Yes, for clients |
| Validity | Three years | 12 months | 12 months |
| Exam (new candidate) | 75 questions, 90 minutes, 75% | 60 questions, 90 minutes, 75% | 60 questions, 90 minutes, 75% |
ISA and QSA details are summarised from the companion page. See the PCI ISA and QSA Certification Guide for their eligibility, List A and List B certification gates and annual requalification.
- Choose PCIP if: you build, run, sell or govern systems in PCI DSS scope and need to speak the standard fluently, fill in or review Self-Assessment Questionnaires, or work alongside your QSA, but you will not sign assessments.
- Choose ISA if: your employer has an internal audit function, wants internal assessments, and will sponsor you. PCI SSC's FAQ notes that a PCIP can later become an ISA if an employer sponsors them.
- Choose QSA if: you want an assessor career across many clients and can join a QSA company.
- Already an ISA or QSA: you can opt in to the PCIP so that you keep a portable credential if you change employer.
Exam format and domains
| Item | What PCI SSC publishes (checked November 2026) |
|---|---|
| Prerequisite course | A six-hour online prerequisite course, required before every PCIP training option |
| Instructor-led (in person) | Classroom training, then the exam at Pearson within 30 days of the class |
| Virtual instructor-led | Online training plus webinar on two consecutive days of four-hour sessions, exam via Pearson within 30 days |
| eLearning | Self-paced; 90 days from receipt of payment to finish the training and the exam |
| Exam only | No training; 30 days from the Pearson email to schedule and complete the exam |
| Corporate group training | One-day on-site class (09:00 to 17:00), exam at a Pearson centre within 30 days |
| Exam | Closed book, 75 multiple-choice questions, 90 minutes, 75% or higher to pass |
| Results | Pearson exam results on completion; in-person exams within 10 business days |
| Retakes | Two retakes within 30 days of the failure notice, $200 each, with 30 days of eLearning access per attempt |
| Cancellation | Testing fee forfeited if cancelled with less than 24 hours' notice or on a no-show |
PCI SSC does not publish a weighted domain outline. Its PCIP page lists the course content, which is the best guide to what the exam covers:
| Course module | What to know for the exam | Related NHI Mgmt Group page |
|---|---|---|
| PCI Essentials | The payment transaction flow, the roles of merchants, acquirers, issuers, service providers and card brands, and the family of PCI standards | Payment Card Data Elements |
| PCI DSS Overview | Structure of the standard, applicability, scoping, account data versus sensitive authentication data | PCI DSS Scoping and Network Segmentation Guide |
| PCI DSS Requirements | Requirements 1 to 12 and Appendix A, including what each control objective is for | PCI DSS 4.0 Guide |
| Reporting Fundamentals | What a ROC and Attestation of Compliance are, and who completes them; compensating controls and the customised approach (named in the course description) | PCI DSS Customised Approach and Targeted Risk Analysis Guide |
| SAQ Reporting | When an SAQ applies and how to choose the right one | PCI DSS SAQ Types |
The course description also covers how new technologies affect payment card security and the related PCI standards. The current version of the standard is PCI DSS v4.0.1; check the PCI SSC Document Library for any newer revision before you sit the exam.
Prerequisites and experience
- Experience: the course description asks for at least two years of IT or IT-related work experience with base knowledge of IT, network security and architecture, and the payment industry. The PCIP Qualification Requirements document asks for a CV showing that experience; the training FAQ describes two years as recommended and says there are no formal prerequisites to take the eLearning course and exam. If you are unsure, ask the PCIP programme team before paying.
- Code of conduct: every candidate agrees to the PCI SSC Code of Professional Responsibility, whose principles cover professional competence and due care, security and confidentiality, integrity and compliance with laws and standards.
- Past conduct: the requirements document allows PCI SSC to reject an applicant whose conduct in the previous two years would have justified revocation.
- Fees are non-refundable under the requirements document, so pick the format and date carefully.
Preparation plan
- Weeks 1 to 2, the standard: read PCI DSS v4.0.1 end to end with the glossary. Make one-page notes per requirement: objective, who usually owns it, and typical evidence.
- Week 3, scoping and data: learn the difference between cardholder data and sensitive authentication data, what may be stored after authorisation, and how segmentation reduces scope. See the Cardholder Data vs Sensitive Authentication Data page.
- Week 4, reporting: study the SAQ types, the ROC and AOC, compensating controls and the customised approach. Practise picking the right SAQ for three or four sample merchant set-ups.
- Prerequisite and training: complete the six-hour online prerequisite, then your chosen course. Book the exam early, because the 30-day or 90-day window starts from the class or payment.
- Exam technique: the exam is closed book with 75 questions in 90 minutes, which is about 72 seconds each. Flag and return rather than stall.
- If you fail: you have 30 days from the failure notice to use a retake, with eLearning access, so plan revision time straight away.
Cost, renewal and continuing education
| Fee (USD, excluding VAT, HST and similar) | Current | From 1 January 2027 |
|---|---|---|
| New PCIP training and exam, non-PO | $2,750 | $3,000 |
| New PCIP training and exam, Principal or Associate PO | $1,700 | $1,900 |
| New PCIP training and exam, Individual PO | $2,475 | $2,700 |
| New PCIP exam only, non-PO | $1,700 | $1,900 |
| New PCIP exam only, PO | $1,000 | $1,100 |
| Exam retake via Pearson | $200 | $200 |
| Requalification training and exam, non-PO / PO | $350 / $300 | $400 / $350 |
| Requalification exam only, non-PO / PO | $200 / $185 | $225 / $200 |
| New QSA and ISA opt-in | $300 | $350 |
| Requalification opt-in for PCIP, QSA and ISA | $200 | $250 |
PO means a PCI SSC Participating Organisation; check whether your employer is one before you pay the non-PO rate.
- Validity: three years from qualification. PCI SSC sends reminders 90 days before expiry.
- CPE: at least 10 hours each year and 30 over a rolling three-year period. The course itself earns CPE: 8 hours for instructor-led training and 6 for eLearning, according to the course description. Time spent sitting an exam does not count.
- What counts: PCI SSC lists its own Community Meetings, forums, training and webinars, plus relevant industry conferences, computer-based training and self-study such as security webinars and books, with some activity types capped in the CPE Maintenance Guide.
- Evidence: keep certificates, transcripts or attendance proof showing the date, description, activity type, your name and the sponsor, for at least 12 months after each CPE cycle. The Council may audit it.
- Requalification steps: submit CPE hours and the requalification registration in the PCI portal before the expiry date, then pass the requalification exam (with or without training) no later than 14 days after expiry. Miss that and you are removed from the PCIP listing and must start again as a new candidate.
- Listing: qualified PCIPs receive a Certificate of Qualification by email, a Credly digital badge, and an entry on PCI SSC's searchable list of PCI Professionals. You may use the PCIP designation only while the qualification is in effect.
Where it fits on the career path
The PCIP is a foundation. PCI SSC calls it a good base for other PCI qualifications, and the natural next steps depend on direction:
- Internal assurance: PCIP, then ISA once an employer sponsors you, then broader audit credentials.
- External assessment: PCIP, then joining a QSA company and qualifying as a QSA, which also needs List A and List B certifications.
- Engineering and product: PCIP alongside hands-on PCI DSS work on logging, key management and payment page scripts, where the credential helps you explain design choices to assessors. See the AI Agents and PCI DSS page for a newer scope question.
- Governance and risk: PCIP combined with a general GRC credential. See the Cybersecurity Certifications Guide.
Hiring managers can verify a holder through PCI SSC's Verify a Professional lookup rather than relying on a CV line.
Common failure patterns
- Treating PCIP as assessor status: a PCIP signing off compliance as if they were an ISA or QSA. Validation still runs through the routes your acquirer and the card brands accept.
- Letting the exam window lapse: the 30-day and 90-day windows run from the class or payment, and fees are non-refundable.
- Leaving CPE to year three: 10 hours a year is required, and evidence must survive a possible audit.
- Studying an old version: learning PCI DSS v3.2.1 detail when the course covers v4.x concepts such as the customised approach.
- Missing the 14-day requalification limit: it means re-entering as a new candidate at the full new-candidate fee.
Practitioner checklist
- Confirm the PCIP fits your role and that you do not need ISA or QSA status for your work.
- Check whether your employer is a PCI SSC Participating Organisation before paying.
- Book before 1 January 2027 if the price change matters to your budget.
- Complete the six-hour prerequisite and pick a format whose exam window you can meet.
- Study PCI DSS v4.0.1, SAQ selection, ROC and AOC basics and the customised approach.
- Set a calendar reminder for yearly CPE logging and keep evidence for audit.
- Register requalification and CPE before expiry and pass the exam within 14 days after.
- If you are an ISA or QSA, consider the opt-in for a portable credential.
Standards and references
- PCI SSC: PCI Professional (PCIP) Qualification
- PCI SSC: PCI Professional Training Course Description
- PCI SSC: PCIP Qualification Requirements
- PCI SSC: PCIP Frequently Asked Questions
- PCI SSC: Training FAQ
- PCI SSC Blog: What to Know About PCIP Requalification
- PCI SSC Blog: Common Questions About Continuing Professional Education Credits
Related NHI Mgmt Group resources: PCI ISA and QSA Certification Guide · Cybersecurity Certifications Guide · PCI DSS 4.0 Guide · PCI DSS SAQ Types