PCI CCA study plan

PCI CCA · Give each week a clear focus.

8 weeks · About 6 hours per week

Week 1

PCI Card Production and Provisioning – Physical Security Requirements

Map the scope of PCI Card Production and Provisioning Physical Security Requirements, listing each major requirement area and its sub-requirements.
Explain the purpose of each physical security control (e.g., access control, video surveillance, intrusion detection) and the risk it mitigates.
Identify the entities and roles covered (e.g., card production, personalization, fulfillment) and their physical security obligations.
Compare the physical security requirements for different facility types (e.g., production, storage, data center) and note key differences.

Create a one-page checklist of all physical security requirement areas with a brief description of each control and its objective.

Week 2

Detail the requirements for secure areas: perimeter security, entry/exit controls, and access authorization procedures.
Describe the standards for video surveillance, including coverage, retention, and review.
Outline the requirements for intrusion detection systems and alarm response.
Explain the controls for media storage and destruction (e.g., shredding, degaussing) and their physical security implications.
Summarize the requirements for visitor management and escorting.

Produce a 2-page summary of secure area controls with specific examples of compliant and non-compliant practices.

Week 3

Analyze the requirements for personnel security: background checks, training, and termination procedures.
Describe the physical security measures for card production equipment and materials (e.g., blank cards, embossing plates).
Explain the requirements for secure transportation and courier services.
Identify the logging and audit trail requirements for physical access and asset movement.
Outline the incident response and reporting requirements for physical security breaches.

Draft a table mapping each personnel and material security requirement to a sample control and evidence source.

Week 4

Review Domain 1 by completing 30 practice questions (self-created or from approved sources) and scoring at least 80%.
Introduce Domain 2: list the logical security requirements and their sub-requirements.
Explain the concept of logical access control and its role in card production and provisioning.
Compare logical security requirements for different environments (e.g., production, test, development).

Score at least 80% on a 30-question Domain 1 self-assessment and write a one-page overview of Domain 2.

Week 5

Detail the requirements for user authentication, authorization, and accountability (AAA).
Describe the controls for remote access and third-party access.
Explain the requirements for audit logging, log review, and retention.
Outline the encryption and key management requirements for sensitive data (e.g., cardholder data, keys).
Summarize the requirements for network security (e.g., firewalls, segmentation, wireless).

Create a checklist of logical access and audit logging controls with a brief description of each.

Week 6

Analyze the requirements for system development and change management, including separation of environments.
Describe the controls for malware protection and vulnerability management.
Explain the requirements for secure deletion and media disposal from a logical perspective.
Outline the incident response and monitoring requirements for logical security events.
Identify the logging and monitoring requirements for card production systems.

Produce a 2-page summary of change management and malware protection requirements with examples of compliant practices.

Week 7

Review Domain 2 by completing 30 practice questions and scoring at least 80%.
Compare and contrast physical and logical security requirements where they overlap (e.g., access control, logging).
Identify common pitfalls and misconceptions in logical security implementation.
Explain how logical security requirements apply to cloud and third-party service providers.

Score at least 80% on a 30-question Domain 2 self-assessment and create a Venn diagram of overlapping physical and logical controls.

Week 8

Complete a full-length practice exam (60 questions) covering both domains and score at least 85%.
Review all incorrect answers and document the underlying requirement for each.
Revisit weak areas identified in weeks 4 and 7.
Create a one-page quick-reference sheet of key requirements and definitions.
Simulate exam conditions with a timed 90-minute session.

Achieve a score of at least 85% on a full-length practice exam and produce a personalized quick-reference sheet.

Week 2: Explain the purpose of each physical security control area without notes and pass a 10-question quiz on secure areas with 90% accuracy.

Week 4: Score at least 80% on a 30-question Domain 1 assessment and submit a one-page Domain 2 overview.

Week 6: Score at least 80% on a 20-question quiz covering logical access, audit logging, and encryption.

Week 8: Score at least 85% on a full-length 60-question practice exam and complete a quick-reference sheet.