PCI CCA
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
PCI CCA refers to the Card Production Security Assessor (CPSA) qualification listed by the PCI Security Standards Council under its PCI Qualified Professionals program. It is aimed at individuals and organizations that assess and validate compliance of card production and provisioning environments against the Council's Card Production and Provisioning security requirements, published in two companion documents: Physical and Logical. Candidates typically come from assessment firms, personalization bureaus, card manufacturers, and issuers' security teams. Preparation centers on reading both requirement sets closely, mapping each control to evidence an assessor would collect on site, and understanding how physical controls (facility zoning, access, media handling, destruction) interlock with logical controls (key management, access control, audit logging, system hardening, provisioning data protection). The Council's site lists a Card Production Security Assessor Training course under Training & Qualification, which is the natural starting point; the site does not publish an exam blueprint, item count, duration, passing score, fee, retake policy, or validity period, so confirm those details directly with the Council before scheduling. Because the two domains are equally weighted in scope, avoid studying one to the exclusion of the other.
What you'll study
About PCI CCA preparation
What is the PCI CCA exam actually called?
The Council's site lists the qualification as Card Production Security Assessors under PCI Qualified Professionals, and the related course as Card Production Security Assessor Training. Treat "PCI CCA" as a shorthand label; use the Council's own program naming when you register or correspond with them.
What does the exam cover?
The scope is the Council's two Card Production and Provisioning security documents: Physical and Logical. Expect facility controls such as zoning, access, media handling and destruction alongside logical controls such as key management, access control, audit logging, hardening and protection of provisioning data.
How many questions, how long, and what is the passing score?
The Council's public page does not state an item count, duration, passing score, or fee for this qualification. Do not rely on figures from forums or older study guides. Request the current program guide or contact the Council directly before you book.
How much does it cost and what is the retake policy?
Not published on the source page reviewed. The Council does publish a Fee Schedule under Training & Qualification, which is the correct place to confirm pricing, and any retake terms should be confirmed in writing with the Council rather than assumed.
How long is the qualification valid?
The source page does not state a validity period or recertification cycle for the Card Production Security Assessor qualification. Ask the Council for the current terms in writing, since assessor qualifications elsewhere in the program are time-limited and you should not assume this one is permanent.
Is there a training course I should take first?
Yes, the Council lists Card Production Security Assessor Training under its Training & Qualification programs, alongside a class schedule and corporate group training options. Start there, then read both Card Production and Provisioning documents in full rather than relying on summaries.
What study order works best?
Read the Physical document first, because facility zoning and media flow give context for why logical controls exist. Then study the Logical document, tracing key management and provisioning data paths end to end. Finish by practicing evidence requests: for each requirement, write what an assessor would sample, observe, and interview.
What are the most common failure modes?
Candidates usually lose marks by memorizing control lists without understanding evidence: they cannot say what a sample, an observation, or an interview would prove. Others over-study one domain, or assume exam logistics from outdated sources. Build a requirement-to-evidence table covering both documents before sitting.
Does this make me a Qualified Security Assessor?
No. Card Production Security Assessors is a separate listing from Qualified Security Assessors on the Council's PCI Qualified Professionals page. Each qualification has its own training and scope; holding one does not confer the other, so verify which listing your client or employer actually requires.