It requires at least an annual review and evidence that the program specifically covers phishing and social engineering, not just generic security content.
HRM glossary
PCI DSS 12.6
PCI DSS v4.0 requirement on awareness programs that must include phishing.
What is PCI DSS 12.6?
ISO/IEC 27001 — International standard for information security management.
DPA (Data Processing Agreement) — Data processing agreement between the customer and Whalemate.
Security awareness training — The category already installed: training people in cybersecurity. HRM is what comes next.
HRM glossary
Questions about PCI DSS 12.6
What is PCI DSS 12.6?
PCI DSS v4.0 requirement on awareness programs that must include phishing.
How does Whalemate use it?
It requires at least an annual review and evidence that the program specifically covers phishing and social engineering, not just generic security content.
Blog
Articles, guides and analysis on human risk management,
awareness and security culture
Guides and analysis for CISOs, IT and compliance teams in LATAM who need to explain the human factor — and decide what to do about it.
HRM
Sep 30, 2026By Federico Hombre
Smishing and vishing under PCI DSS 12.6
SMS and voice are not the same for CISOs and compliance. PCI DSS 12.6 requires formal awareness and separate measurement of both channels.
Read more
HRM
Sep 18, 2026By Federico Hombre
PCI DSS 12.6: Vishing and Smishing Scope
Vishing and smishing are no longer just phishing variants. Under PCI DSS 12.6, they require a formal program, channel metrics, and steady improvement.
Read more
HRM
Sep 16, 2026By Federico Hombre
PCI DSS 12.6 Requires Vishing Coverage
Vishing and smishing are voice and SMS phishing. Under PCI DSS 12.6, measuring only email or course completion leaves a compliance gap.
Read moreWant to see HRM in your organization?
Book a demo and we'll look at the program with data from your industry.