In this timetable,
I'm assuming that you're progressing through the exam‑only option for the PICP.
The first thing to know is that you only have 30 days to
book and pass the exam once your application to be a PCIP
has been accepted by the PCI SSC.
So you should only start this process when you finish studying and you
are confident that you know the material adequately.
The first step in the process is to fill out the online registration
form and submit an up‑to‑date copy of your CV.
The online registration form is available on the PCI SSC website,
either by following the links to PCI Professional or from the
address on screen now. In the application process,
you have to agree to the PCI Code of Professional Responsibility.
I'm going to quickly mention this here so you're aware of what
you have to sign up to and also because it's a subject that can
be examined in the PICP exam. The Code of Professional
Responsibility covers four areas.
The first area is professional competence. To the PCI SSC, professional
competence means that you take due care by making sure you're acting in
the best interests of all the entities you provide services to and that
you're consistent with the PCI standards and guidance. Or basically,
just do a good job.
Also, that you only do or you only give advice about the things you're
qualified to give advice about and that you keep yourself up to date with
both security and the PCI standards. And finally,
that you promote best practice in information security
and that you promote the standards.
The second principle in the Code of Professional
Responsibility is security and confidentiality.
And basically, this says you must respect and safeguard confidential
property or otherwise sensitive information that you come into contact
with, and importantly, notify the relevant authorities if you suspect a
data compromise or a breach in security.
The third principle is integrity, and this requires professionals
to refrain from conduct that would damage or reflect poorly on the
reputation of the PCI SSC or its standards, to report ethical
violations, and to refrain from activities which might constitute a
conflict of interest.
A good example of something that would be a conflict of
interest will be a QSA, for instance,
insisting that a customer took other services from the QSA company in
order for the QSA to consider the customer compliant.
The third principle also requires you to be objective in what you do.
The final principle is to perform all your PCI‑related duties in
accordance with the PCI standards and to comply with existing laws
and regulations with the proviso that local laws always take
precedence over PCI standards.
A violation of the Code of Professional Responsibility can lead to a
written warning, suspension from all PCI programs, or in the worst case,
revocation of all PCI program qualifications.
I've highlighted this Code of Professional Responsibility
and the sanctions available to the PCI SSC because as well
as them being very important,
people who write exams find it really easy to ask multiple choice
questions that cover this type of material.
Okay, so you sent off your application. Well, what happens next?
The PCI SSC will review your CV and check your application.
They're making sure that you fulfill the prerequisite requirement for two
years of work experience in an IT or an IT‑related role.
And this can be interpreted quite loosely.
So if you're not sure about how closely your role is IT related,
put it in your CV, detail your employers, say what you've done in your
roles, and explain why it was IT related or related to payment
processing, and generally this will be fine. Once the PCI SSC is happy
that you meet the eligibility criteria, you'll be asked to make your payment.
Now, I've got to warn you. When I recorded this training,
you either had to phone the PCI SSC to make a payment or send
a fax or a check or make a wire transfer.
I've heard rumors that an online payment system is on the way,
so by the time that you're ready to pay for your PCIP exam,
you may just be able to pay online.
I should also just really quickly point out that if there are a number of
you from an organization who wants to take the PCIP exam,
it's actually cheaper for the organization to join the PCI SSC as what's
called a participating organization because then you get a discount for
every individual PCIP application. Details of the participating
organization program are on the PCI SSC website. Once your CV has been
checked and your payment processed,
the PCI SSC will notify you and tell you how to book your
exam with the Pearson VUE testing center.
You need to go online,
book the examine at the testing center, and probably one that's near you, and
then you go to that testing center and just pass the exam.
I know, that was easy to say it, wasn't it? Just pass the exam.
And you need to do this passing of the exam in 30 days from
receiving the notification from the PCI SSC.
So remember, don't start this process until you're ready to take the exam.