PCI DSS in Practice: Protect Card Data Where It Actually Lives
Signature Course No. 422 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's PCI DSS in Practice: Protect Card Data Where It Actually Lives course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
Card data does not live where the diagram says it lives. It lives in the call recording nobody remembered to pause, in the spreadsheet a well-meaning manager kept to sort out refunds, in the back-office computer that was only supposed to run the roster, and in the network segment that was supposed to be separate until a printer was plugged into the wrong socket. This course teaches you to protect card data where it actually lives: what counts as cardholder data and what must never be stored at all, how to follow a payment card number from the moment a guest, a customer, or a client hands it over until the moment it is gone, and how each of the twelve requirements of PCI DSS, as published by the PCI Security Standards Council, applies to stored and transmitted card data in a real business.
It starts with knowing what counts. The standard divides payment card information into two families that carry different duties: cardholder data, centered on the primary account number, and sensitive authentication data — the track data, security codes, and PIN material that must never be stored after a payment is authorized, even encrypted. You will learn the two working tests that sort almost every case you will meet — the PAN test and the after-authorization test — and you will work throughout on one running company, the Mallowbrook Hospitality Group: three hotels, a central reservations desk, restaurants, and an online shop, whose facts are stated once, in full, and never quietly changed.
It works in two movements. First, Module 1 — Find the Data and Draw the Line — work through Concepts 1–9, finishing with The Scope and Storage Pack; then, Module 2 — Run It, Prove It, Keep It True — work through Concepts 10–18, finishing with The Validation and Evidence File.
Both capstones produce real artifacts — a scope and storage pack for a fourth property Mallowbrook is about to buy: its data census, its flow map and stored-data register, its defended environment boundary, and its day-one decisions; and a validation and evidence file for the group itself: its provider duty record for eleven providers, its questionnaire decision defended gate by gate, its exceptions and evidence index, and its scope-confirmation page — each defended in writing.
The honesty standard is part of the course. Completing this course does not make any business compliant with PCI DSS, and no page of it says so: compliance is a state an organization reaches in its own environment and shows through its own validation — a Self-Assessment Questionnaire, an Attestation of Compliance, or a Report on Compliance written by a qualified assessor — judged against the standard in force at the time. The book teaches the published structure of the current major version, and where a version-specific point can move — effective dates, questionnaire eligibility wording, assessor program rules — it says so on the page and carries the item on a verify-current list. This course is information about a security standard, not legal advice.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
PCI DSS in Practice: Protect Card Data Where It Actually Lives is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning has delivered since 2002.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with what counts as card data. Name every place — system, file, inbox, recording store, and paper location — where you could today read a full card number if you went looking, and say which of them surprised you; say whether any process you run captures a security code, track data, or a PIN at any point, and who has checked what survives it; and say whether your staff distinguish the number itself from the authentication data when they say "card details." Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Scope and Storage Pack for Module 1 and The Validation and Evidence File for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
See the estate, protect what you found, prove it and keep it true. Three threads run through the whole course. You cannot protect a card number you have not found, so the course returns again and again to finding, mapping, and bounding the data; each protection is then taught where the data sits — at rest, in motion, behind an identity, inside a room, on a system built and patched to stay honest; and a protection nobody can show is a hope, so the course closes with governing paper, provider duties, the right validation path, testable evidence, and the yearly discipline that keeps scope from drifting.
Module 1 finds the data and draws the line. Know What Counts as Card Data; Follow the Data; Draw the Cardholder Data Environment; Shrink the Estate; Protect Stored Account Data; Protect Data in Transit; Access by Need to Know; Identify and Authenticate; and Physical Access and Media — the estate built piece by piece, then shrunk on purpose.
Module 2 runs it, proves it, and keeps it true. Build It Secure; Keep It Clean and Current; Log Everything That Touches Card Data; Test the Defenses; Govern the Estate; Providers Who Touch Your Cards; Choose Your Validation Path; Prove Each Requirement; and Keep Scope True All Year — the operating requirements, the proof side, and the calendar that keeps the attested estate the real one.
And it holds its boundary throughout. This course owns one estate only: the cardholder data environment — the people, processes, and systems that store, process, or transmit payment card data, and the systems that can affect its security. A neighboring course teaches the general internal-controls playbook for a whole business, and another maps security frameworks at the program layer; this course never leaves the card-data estate to become one of them, and never teaches a control that cannot be traced to a card, a card flow, or a system that can reach one.
What you will learn
- Tell cardholder data from sensitive authentication data, and state what may never be stored after a payment is authorized
- Map every flow a card number takes through a business, and build an inventory of every place it lives
- Draw the cardholder data environment, judge what is connected to it, and shrink it by segmentation that you can prove
- Apply the PCI DSS requirements for stored data, transmitted data, access, authentication, and physical protection to real card flows
- Run the operating requirements around card systems: secure builds, patching, logging, and regular testing
- Govern the estate with card-specific policies, a risk assessment, an incident plan, and written provider duties
- Choose the right Self-Assessment Questionnaire for the way you take payment, and assemble evidence an assessor can test
- Keep scope true all year, so a change in the business never silently becomes a change in the estate
Everything in the course
- All 18 concepts of PCI DSS in Practice: Protect Card Data Where It Actually Lives, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Scope and Storage Pack and The Validation and Evidence File
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the people who own the card-data estate
Operations and IT leads in retail, hospitality, and finance operations — who own the systems that take, move, or store card payments and carry the card-data environment day to day; and property, store, and branch managers — whose front desks, tills, and back offices are where card data actually appears, and whose habits decide whether it stays protected.
Compliance and risk staff — who own the validation calendar, answer the acquiring bank's letters, and assemble the evidence file.
Finance staff who handle refunds, chargebacks, and reconciliations — whose legitimate work is the most common reason full card numbers turn up in places they should never be. This course assumes you work in or around a business that accepts payment cards, and that you can recognize your own tills, booking systems, phone lines, and back-office computers when they are described. It does not assume a security background, and it never asks you to configure a firewall.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Know What Counts as Card Data
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
PCI DSS in Practice: Protect Card Data Where It Actually Lives is Signature Course No. 422. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.