PCI ISA training experience

6/15/2012

I just returned from the 2 days PCI ISA training in Florida. The environment in Orlando (sun, close proximity to Disney, pools, and bikinis) does not help to concentrate on study of such a topic. And the exam... Even though, of course, you cannot compare it to something like CISSP, but still - it would require some efforts to pass (I don't know about the results yet though).
Anyway, it was good experience - observing the QSA program from inside (basically, the ISA is the same as QSA but without ability to work as QSA). Now I even better understand the reason for ambiguous definitions and weird interpretations of PCI. The PCI DSS consists of 12 main requirements. In order to validate each of 12 requirements during the audit, QSA is provided with Testing Procedures which are listed in the same document. There are total of 310 (!) testing procedures. The net duration of training is about 10 hours or 600 minutes (2 days minus time for introduction, final exam, and breaks) which leaves the instructor with less than 2 minutes per testing procedure - including explanation, samples, questions, knowledge check etc.
Note: Information about PCI DSS Requirements (including Testing Procedures) and QSA Training is publicly available which allows to calculate the numbers above without any "inside" knowledge.

54 Comments

Communication Training link

6/27/2012 01:04:16 am

Comment deleted

Blake

7/9/2012 07:03:36 am

How did the training go? How many hours of out of classroom studying did you have to do? Just trying to determine how in-depth the exam is and if you can pass just by understanding the purpose the the requirements and understand how to assess them.

Slava Gomzin link

7/10/2012 05:27:06 am

I have previous experience with both PCI DSS and PA-DSS (and now - PCI P2PE as well) - mostly with PA-DSS though. If you have experience in PCI compliance area, you should not have any problems with this certification, even though the course is pretty extensive, and the exam was tougher than I thought. (BTW, I just received my ISA certificate).

Guillaume link

1/11/2013 07:51:24 pm

I am trying to decide between instructor-led training and online training. Any comments would be appreciated.

Thanks!

%3C%68%31%3E%54%68%69%73%20%69%73%20%61%20%74%65%73%74%3C%2F%68%31%3E link

6/26/2019 12:30:44 pm

%3C%68%31%3E%54%68%69%73%20%69%73%20%61%20%74%65%73%74%3C%2F%68%31%3E

Vlada

11/29/2012 05:04:14 pm

Great blog but unfortunately without many duscussions. Me and my colleague are going to Orlando in february 2013 :) Can you please give us more details about the test (number of questions, question types (case study questions or theoretical), duration of the test...). How to prepare for the exam, is there any study material or pcidss standard is enough? What is your opinion, who has better chances to pass the exam someone with it audit background or somone with it security technical background? tnx

Slava Gomzin link

11/30/2012 06:52:08 am

I don't remember details such as number of questions in the exam (I should have them documented back then!). What I know from conversations with QSAs is that the complexity level of the QSA (and new ISA) exam has been recently elevated so now it is close to "real" industry certification. I could feel it as I expected easier test. However, It is still doable if you have some previous experience with PCI and security. Most of the questions are around PCI and based on the materials they provide during the training. If you study these materials plus you have some PCI and security related background - you should not have any problem to pass it.

Babaji

1/7/2013 05:13:19 am

I am trying to decide between instructor-led training and online training. Any comments would be appreciated.

Thanks!

Jamie

1/9/2013 02:39:54 am

Do you have any other certifications/training that you think helped you with the ISA training? I don't have any security certs but have been in industry for 10 years and responsbile for PCI compliance for 8.

Blake

1/9/2013 03:39:19 am

Probably the CISSP as it would help you with the terminology and methods. However, if you just keep focused on the PCI DSS standards and the navigating PCI documents on the pci standard website you should have no problem.Those documents provide you with everything you need. Understand the intent of each requirement and any associated frequencies. I can't stress enough that it is important to just keep reading through the PCI documentation on the PCI DSS website.

Jamie

1/13/2013 01:26:32 am

Thanks!

2/21/2013 07:50:30 am

Do you feel taking ISA exam enables you to complete the self-assessment of all controls? This will help our business save money on hiring a QSA.

John Bibby (JB)

3/18/2013 03:44:52 pm

I'm enrolled in the online course and going through the fundamentals material. Do you remember if the exam questions were around the intent of each requirement or if they were more scenario based? I've been involved with the PCI efforts in my company for some time now and will be taking the ISA exam in a few weeks after I complete the coursework. I'm assuming after the fundamentals section is completed (if I pass) I'll be given some more material to review in preparation for the actual certification test. Even the fundamentals material seems quite easy but that worries me in a test like this. Any guidance or insight you can provide would be helpful. Thanks,

JB

Billy

5/2/2013 06:16:20 am

I recently failed the ISA exam and would like to get some more info on the study direction I should take. I've been in IT operations for over 10 years, am familiar with the technical side of the security industry, but have had absolutely no prior audit experience. My company also does not have any existing PCI program or awareness and I've only been introduced to PCI within the last 5 months - but did not seem to have any issues comprehending everything in the online course and assessments. I understand the PCI DSS Glossary from experience, but short of memorizing the gory details of the DSS requirements to the point that it's test procedure X.2.2 or X.2.4 that is the correct answer, I don't know where else to look for training materials. During the exam, I was very confident about my answers, but was rather concerned that it only took about 20 minutes to make my first pass through all of the items. Of the 5-10 or so I had marked for review, I could not even find mention in any of the training material or the PCI DSS 2.0 for some of the terms used, and the others seemed so high level, it was almost impossible for me to not over think them to an incorrect answer. Any help regarding where to focus for my retake would be greatly appreciated. If it's just, "study the glossary and DSS", that's fine, I've seen/heard it before, I'm just looking to see if an instructor lead class or any other approach might be more beneficial. Thanks in advance.

Billy

9/3/2013 07:05:17 am

** UPDATE **
I wanted to share my ISA re-take experience with everyone. I did pass the exam on my second attempt, and focusing on the material while forgetting what I knew, seemed to be the key.

Off the street newbie or 15 year vet, just approach this from the angle that PCI is gospel, and you will be fine. My previous comments still hold true, the on-line study course is an introduction at best and following the advice of others here, I focused completely on the supplemental documents listed in the training. This is all memorization and familiarization with the material. In comparing both of my experiences, I went from my first test taking about 30 minutes to get through all of the questions, and spending about an additional 15+ minutes on the questions I had marked for review, to my second attempt where I was completely done in less than 20 minutes and had only marked one question for review. I did seem to have a different set of questions then my first exam, as well as not being phased as much by the "gotchas" this time.

This exam, much to my previously voiced dismay here - "short of memorizing the gory details of the DSS requirements to the point that it's test procedure X.2.2 or X.2.4 ", for me, required memorizing the gory details to the point that it's test procedure X.2.2 or X.2.4.

I do not want to imply that the exam is all detail oriented as opposed to fundamental application, but the bit of info everyone wants to get out of this type of exam prep is "What do I need to know, without filling my mind with useless info I'll never be tested on?". It’s difficult to pick out which parts of what section or document will show up in the exam. Trying to memorize the details of all the requirements will get you very far in this case, and although you may not find yourself guessing between X.2.2 and X.2.4 very often, getting to that point where you can rule it down to 1 or 2 possibilities alone will put you very close to passing.

My tip of advice would be to start with the glossary - if there is a single definition that you do not understand, understand it before moving on. After that, get out your favorite brain food, the rest of the suggested documents, a successful memory retention technique, and go find a happy reading place…….

Thank you everyone for the advice and good luck to those preparing for their exam.

Slava Gomzin link

5/3/2013 04:15:09 am

Billy,

Based on your comment, it sounds like you have not done the training class provided by PCI SSC, correct? If so, given the act that you have minimal PCI experience, I would recommend you to sign up for the class. As far as I remember, most of the questions in the exam were based on either printed training materials (which they provided for the class) or instructor's explanations and examples.

Billy

5/8/2013 07:47:56 am

Slava,

Thanks for the response. I did take the two online courses that the PCI SSC offers for the ISA certification - an initial assessment, and then a much more in depth training class, around 6+ hours on the latter. My concern is that I'm missing out on something by only being exposed to the content in the online course, as opposed to an instructor lead course. With the online training, there is no printed material provided, just web based lecture/slides.

Slava Gomzin link

5/8/2013 08:41:02 am

Billy,

As far as I remember, the printed course materials provided back then were also based on presentation slides, but I don't know for sure whether they are the same for online course. What I do remember is that I was surprised by complexity of the exam questions. I guess I was not confused and passed relatively easily just because I had recent experience with Security+ and especially - CISSP exam, which is a recognized champion on level of difficulty in security area.

Nate

5/8/2013 10:03:05 am

I also took the online course, and failed the exam today. Here is what I can tell anyone who reads this: DO NOT RELY ON THE COURSE alone to pass. You must search out the PCI-DSS 2.0 documents and information supplements on their website, and study them extensively.

You must know the requirements, and all related testing and documenting procedures to pass this exam. Just watching the training videos will not be enough for most people to pass. Study each and everyone extensively.

I went through the online training course three times, took detailed notes and invested 25+ hours into preparing for this.

They do not give you a score, so I don't know if I completely bombed it, or just barely failed.

I have worked in IT for over 15 years, and have fairly a fairly strong understanding of payment systems, PCI, and network security, but none of that helped. This test is more about memorization than comprehension.

I feel that the instructor led courses probably help point you in the right direction of study more so than the online course. If your company is willing to send you to a classroom training, do it!

Read the guides, know the requirements and time frames of testing and data retention. Then read it again, and again. DO NOT RELY ON THE ONLINE COURSE ALONE TO PREP FOR THIS EXAM. At the very least watch module two several times, and memorize it.

Now that I took the actual exam, I know where to double down my efforts, and expect to pass this time around, but learn from my mistakes and you will pass the first time around. If you think going through the online course once, or even twice is sufficient, you will have a very difficult time passing.

Michael

5/29/2013 07:13:00 am

Nate is right about making sure that you read all the supplement materials and several other of the supporting documents that they have on there site. Make sure you also are very versed in the acronyms in the glossary.

They ask very straight forward questions but if you don't know the material you will not be able to pick the correct answer.

I passed today on my second attempt, this test was just as hard as the first but I don't think there any questions that were the same as the last test. Pretty sure that if I didn't put all the time into studying I would not have passed.

Deryck

6/4/2013 04:03:02 am

Great forum, wish though there were more responses. I took the two day instructor course and felt pretty comfortable on the material. Took the test and apparently did not score high enough. I say apparently because all they will tell you is that you either passed or failed and that you can retake the course for $250. I was pretty pissed at first however realized that I should have put some time in before the course to absorb the overall information. I agree with the above responses to Billy. The course material alone is definately not enough for the questions on the test. It was expressed at the beginning of the course that the test questions are considerablity harder the prior tests. If you plan on taking the course and then the test make sure you study all the information and documentation provided on the PCI-DSS. There is a lot of information on the SAQ.

Peter

6/19/2013 06:49:18 pm

So can anyone confirm what the test looks like - how many questions, is it multiple choice or essay? Thanks

Melanie

6/20/2013 05:53:10 am

I just took and failed this test yesterday. Billy nailed it and I totally agree with him. I took the online course and I studied Module 2 extensively and there were very few questions on Module 2. They are high level and I know I overthought most of them. To answer Peter's question, there are 60 questions, all multiple choice. I'm wondering how many are in the "bank" of questions and how different the next try will be.

Peter

1/5/2014 04:15:15 am

I finally got around to doing my PCI-ISA exam in December and passed on my first attempt. I can tell you there are 60 multiple choice questions. Because the requirements are so broad, it's impossible to say what may come up in the questions. I would, however, echo what others have said, study the navigation guide and also the sample ROC that is available on the PCI website.

I studied in my own time using the online material and didn't do any classroom based courses for this. I do, though, hold both CISA and CISSP qualifications.

I attended a PearsonVue examination centre in the UK and the first thing I did was to write down the 12 requirements which I'd learned verbatim so that when a question said wihch requirement covers firewall configuration, I was able to narrow it down very quickly.

As others have said, the exam is no where as difficult as CISSP and I would agree with that.

Good luck to anyone else planning to do this in the new year.

Slava Gomzin link

6/20/2013 09:34:23 am

I have created a separate menu entry -- "PCI ISA" -- which contains direct link to this blog entry so everyone can just click on the direct menu link and share her/his experience about ISA certification process - training, exam, and more. Thank you for taking the time to share your stories!

Toronto class

7/22/2013 03:15:24 pm

I just passed my ISA exam following a 2 days course. My advise is that before getting into the class you become familiar with "navigating the PCI dss" and the standard document from the SSC site.
The instructor was excellent, in fact he told us exactly what we needed for the exam. The exam is 75% straight forward and the 25% gotcha questions but are easy questions nonetheless. Be focus on the 2 days during the class and review based on the highlight of the instructor. This is not even close to CISSP or CISM

Boston Class

8/12/2013 09:58:18 pm

I going to attend Boston class and I would like to know do I need to memorize all sub-requirements with their corresponding numbers.
I will appreciate if you like to provide any suggestion about the training and exam.

Roger

8/26/2014 07:59:47 am

Boston class... did you need to memorize the sub-requirements?

Slava Gomzin link

9/10/2013 11:16:02 am

Well, I work for different employer now (Hewlett-Packard) so technically I am not ISA anymore. My new position is not related to internal assessments so I am not going to renew my ISA certification with HP. I wish all the ISAs - current and future - good luck! And I am still PCIP!

9/18/2013 05:18:08 am

Veteran in IT, but failed the first attempt.

Scored on the second attempt after knowing what the h**l they are after in the exam.

And there is only one answer: Memorize everything !

This is a stupid test, but it is what it is.

Hank

9/24/2013 05:57:52 am

Anybody know what is the salary range for a certified PCI ISA ?

Mike Walden link

9/24/2013 07:18:33 pm

Awesome blog. I enjoyed reading your articles. This is truly a great read for me.

dissertations superior paper link

11/14/2013 04:30:22 pm

This exam, much to my previously voiced dismay here - "short of memorizing the gory details of the DSS requirements

Ray

12/10/2013 09:22:24 am

Hi all
I failed on my first try. There is a conspiracy theory that the PCI deliberately fails entrants on the first try. Ever wondered why they dont release the exam results ?

Raj

1/24/2014 08:05:35 am

Hi,

I am going to take the course in February. Can you please advise on the duration of the exam ?

Thanks in advance.

Slava Gomzin link

1/24/2014 08:33:48 am

Hi Raj,

Back in 2012 it used to be something like 2 hours - now I don't remember exactly. I hope that people who recently made it will reply. Good luck!

Regards,

Slava

Raj

1/25/2014 09:29:33 am

Thank you for the information. I am planning to write the Fundamental Exam this week which is a prerequisite to attend the training. Any advice for that ?

Thanks
Raj

Raj

1/25/2014 09:29:47 am

Thank you for the information. I am planning to write the Fundamental Exam this week which is a prerequisite to attend the training. Any advice for that ?

Thanks
Raj

Raj

1/25/2014 09:31:02 am

Thank you for the information. I am planning to write the Fundamental Exam this week which is a prerequisite to attend the training. Any advice for that regarding preparation before attempting to write that ?

Thanks
Raj

Slava Gomzin link

1/26/2014 02:13:22 pm

Hi Raj,

As far as I remember, back in 2012 the Fundamentals exam used to be an online test, which makes it simple by definition. It depends on your previous experience, so if you already are familiar a little bit with PCI there should be no problem. However, things may have been changed since then.

childrens book illustrators link

1/30/2014 02:27:42 am

anyhow, it was good know-how - observing the QSA program from interior (basically, the ISA is the equal as QSA but without skill to work as QSA). Now I even better appreciate the origin for ambiguous delineations and odd interpretations of PCI.

rudy link

5/12/2014 11:03:35 pm

nice blog

Siva

5/22/2014 08:36:25 pm

Hi Everyone,
I am Siva from Hong Kong. Currently, I am a System Auditor in a Credit Card company in Hong Kong. We do have all the PCI DSS related work and background in our company. I am interested in taking up PCI-ISA exam.

My question is,

Can I take PCI ISA exam personally at the beginning ? and later Can I provide experience attestation from my company? like CISA or other certification. Or How does it work ?

Slava Gomzin link

6/2/2014 05:27:50 am

Hi Siva,

I guess the best way to get answers to your questions is addressing them directly to the PCI Council. You can contact them via email at [email protected].
My understanding is that if you are going to be ISA, first you need to get your company sponsorship. However, if you are looking for personal certification - there is PCIP certification which is in a sense personal version of ISA, and you are not going to lose it even after you leave your company, or your company does not want to participate in ISA anymore. You can get more information from the Council about PCIP by emailing them to [email protected].

Best Regards,

Slava

membaca ini link

6/1/2014 11:21:15 am

Ada Terasa Untuk Cari Tentang ini. Saya Asumsikan Anda Terbuat Tentu Faktor Baik Dalam Fitur Juga.

Alex

10/12/2014 05:29:23 pm

A few months back my boss asked me to study up on PCI Compliance to become an ISA, I said what the heck and started with the PCI Fundamentals took the first exam and thought it was ok not that difficult. I'm soon to start the second part of this certification (ISA eCourse + Final exam) I've been on the internet familiarizing myself with the entire ISA process and after reading much stories I'm a bit worried sounds like a very comprehensive and detailed exam. Weird thing is that my main role in this company is as a programmer. Lets see how it goes :)

Lucas Allen link

11/19/2014 11:33:16 pm

I have worked with PCI for over 8 years mostly advising and conducting training. Personally I found the instructor led training great and very useful to apply some of the theory in the case studies and work with colleagues it makes the learning experience must better. I was also able to ask question to the trainer which really helped. No major issues with the exam, I found around 65% common sense and didnt need to double check my answers, the rest I had to think twice, some of them are trick questions and some are quite specific to each requirement. Passed first time ! :)

PCI LOST

8/5/2015 05:53:16 am

Hi All,
It is now 2015 and this blog is fairly old, however I have read all the posts above. I too have taking the online course. I have taken it or been through it about 35 times, however the part I am struggling with is the memorization of the "2.2.x or 6.4.x". Since the ROC actually has all the sub-sub requirements in the guide when you are going through it, I am not sure the value this adds to the course. I know all the ASV, SAQ, ROC but it sounds like I do need to memorize all 256 requirements and sub-requirements. is this correct? It also sounds like I have to know exactly every abbr in the glossary of terms. What are the supplemental readings everyone is talking about? Also, do you need to know the payment card requirements for Level 1, 2, 3, 4 for AM, Disc, JCB, Visa and MC? Please help. I must pass and this is Version 3.1. Thank you!!!!

Ravi link

6/28/2017 08:09:29 am

Check out the PCI ISA prep plan here : https://theauditstuff.blogspot.in/

Joshua Kennedy

8/10/2020 10:21:14 am

I Just got my ISA Friday 8/7/2020
If you know this book you will ace your ISA.

Payment Card Industry Professional by Linda Jones.

Shawn

4/22/2021 06:37:07 pm

Hi Joshua, are you referring to this book?

Payment Card Industry Professional: PCIP Certification 320 Practice Questions and Exercises

Thanks!

Tara Forrest link

12/4/2020 03:02:59 am

Appreciate your bllog post

Mehdi

6/1/2021 11:21:48 pm

I just passed the exam an hour ago.
Your best resource is PCI training slides.Exam questions were a little challenging but you can pass it without paying for books or other trainings( I obtained the mentioned book and it is useless. I registered for Udemy course and that was useless too.)

Feya

2/22/2022 09:11:26 am

Like Mehdi said, book and udemy courses are both useless. PCI training was also useless and like a joke (at least mine was), the instructor spent half day talking about how credit card payment works, then spent afternoon going through 12 domains based on the slides. I found some youtube videos and even these are better than that instructor. I also asked them what we should focus on the test, how much foundation info will be covered in the test. They were just being extremely unhelpful, saying 'I don't know, you should review everything'. Come on... We paid 3k, at least make the training be more professional and helpful but not let us play the puzzle.
All you need to review is the guideline, be sure to remember everything, like the sub controls. For example, they ask you how do you test antivirus, what does audit trail include. just keep reading the PCI DSS guideline again and again.

Author of books Crypto Basics, Bitcoin for Nonmathematicians, Hacking Point of Sale

PCI ISA training experience

Leave a Reply.

Categories

Archives