The key to an effective security awareness program is in targeting the delivery of relevant material to the
appropriate audience in a timely and efficient manner. To be effective, the communication channel should
also fit the organization’s culture. By disseminating security awareness training via multiple communication
channels, the organization ensures that personnel are exposed to the same information multiple times in
different ways. This greatly improves how people remember the information presented to them. Content may
need to be adapted depending on the communication channel—for example, the content in an electronic
bulletin may be different than content in an instructor-led training seminar, even though both have the same
underlying message. The communication channel used should match the audience receiving the training
content and the type of content, as well as the content itself.
The intent of this document is to provide supplemental information. Information provided here does not replace or supersede requirements in any PCI SSC Standard.