PCI Security Standards Council®

PCI Point-to-Point Encryption (P2PE)™ Assessor Qualification

The Point-to-Point Encryption Qualified Security Assessor (P2PE QSA) and Payment Application Point-to-Point Encryption Qualified Security Assessor (P2PE PA-QSA ) training programs prepare candidates to perform validation of Point-to-Point Encryption solutions and applications against the latest standard in order for those solutions and applications to be listed on the PCI Council website. This course provides a solid foundation of understanding of each of the comprehensive requirements included in the Point-to-Point Encryption Standard. Depending on prerequisites, candidates may earn the certification of Point-to-Point Encryption Qualified Security Assessor qualification or Point-to-Point Encryption Payment Application Qualified Security Assessor qualification.

Registration Process

In order to attend a P2PE training class, your company must already be a validated QSA (P2PE) and/or PA-QSA (P2PE) Company and you must be a full time employee. Please see the P2PE QSA Qualification Requirements for more details.

All training requirements must be submitted by the QSA (P2PE) or PA-QSA (P2PE) Company Assigned Primary Contact through the PCI SSC's Secure P2PE Portal. To receive access to the Portal, the Primary Contact must email the PCI P2PE Program Manager at: p2pe@pcisecuritystandards.org.

All candidates must apply to the program and be approved by the PCI Council to participate. Other requirements include:

  • Must be a Qualified Security Assessor
  • Must be employed by a QSA or PA-QSA company that meets the requirements for a point-to-point encryption company
  • Must have completed two PCI Data Security Standard assessments [and two Payment Application Data Security Standard assessments for PA-QSA (P2PE) candidates]
  • Must have in-depth knowledge of cryptographic and key management techniques

Course Details

The Point-to-Point Encryption Standard is a comprehensive set of requirements focused on providing the requisite security requirements necessary to support the deployment of secure encryption solutions. The training program is comprised of either an eLearning course and one-day remote instructor-led training class with exam through Pearson Vue or an intensive two-day instructor-led course and exam.

Training Overview

This training program covers the point-to-point encryption requirements, sub-requirements and associated testing procedures in depth, along with cryptography, key management techniques, and solution-specific assessment techniques. Candidates will learn how to:

  • Build, test and deploy solutions that provide the tools necessary for PCI Data Security Standard compliance 
  • Evaluate point-to-point encryption solutions  on behalf of the applicable Solution Providers and submit them directly to the Council for review and acceptance
  • Assess in-depth information about all six domains included in the Point-to-Point Encryption Standard 
  • Test and assess point-to-point encryption solutions
  • Prepare basic cryptography, key management techniques, and solution specific assessment techniques 

In addition, candidates for Point-to-Point Encryption Payment Application Assessor will learn how to:

  • Evaluate point-to-point encryption solutions and applications
  • Submit corresponding Report on Validation on behalf of the applicable Solution Providers and the applicable Application Vendors
Training and Exam

Candidates will participate in a two day class. Payment Application candidates will be required to attend an additional session on Domain 2 and take a second exam. Candidates must pass both examinations to become approved Payment Application assessors.


P2PE (QSA) training is a two-day intensive instructor-led course providing:

  • In-person engagement and collaboration as well as networking opportunities
  • Ability to focus on curriculum in classroom setting
  • Learn directly from an expert PCI SSC trainer with hands-on experience assessing merchants and/or service providers

Attendance during the entire two day course is mandatory. Missing more than 30 minutes of the class will automatically result in forfeiture of the PCI SSC P2PE exam and removal from the class.

Taking the exam - The certification exam is given immediately following the instructor-led course. The only document you will be allowed to reference during the testing is a translation dictionary, if needed.  No electronic devices may be used during the exam. This is a closed book exam. The exam consists of 75 multiple choice questions and you will have 90 minutes to complete it. 
*P2PE PA-QSA candidates will also be required to complete an additional exam specifically covering assessment of P2PE applications.

The Primary Contact at the P2PE QSA Company will be notified of results within two weeks after the candidate attends the instructor-led PCI P2PE QSA training and exam. Employees who do not meet the minimum passing score set by the PCI SSC may retake New P2PE training and exam, upon registration and payment of a new invoice. For each attendee that passes the exam, the P2PE QSA Company will receive a certificate that validates the employee for the next 12 months.

How to Prepare

Prior to attending the assessor training session it is strongly recommended you familiarize yourself with the following publications:

  • PCI DSS Requirements and Security Assessment Procedures
  • PCI Payment Application Data Security Standard – Requirements and Security Assessment Procedures
  • PCI PIN Transaction Security (PTS) Point of Interaction (POI) - Modular Security Requirements
  • PCI Hardware Security Module (HSM) Security Requirements
  • PCI PIN Transaction Security (PTS) Device Testing and Program Approval Guide
  • PCI DSS and PA-DSS Glossary of Terms, Abbreviations, and Acronyms
  • PCI DSS QSA Qualification Requirements – Supplement for Point-to-Point Encryption Security Assessors

The following documents must be reviewed in advance of the course:

  • P2PE Standard
  • P2PE Glossary

P2PE 2022 Classes

Remote classes are a combination of eLearning and a live webinar.

Webinar dates are listed below.

Date of Live Webinar
Date: 1 Sep
Time: 0900-1730 (EDT)
Price: $3,000 USD
Please note: All fees are NON-REFUNDABLE and NON-TRANSFERABLE. Unless otherwise specified the training and exam will be delivered in English.

Price does not include any applicable VAT/HST/GST which will appear on your invoice.

Requalification Requirements

In order to maintain the high standards set for this certification, all P2PE employees must re-certify every 12 months in order to continue as a P2PE QSA or P2PE PA-QSA.

All training inquiries and assignments must be submitted through the P2PE Company's primary contact. PCI SSC requires all training attendees to be full time employees of the P2PE Company that they were initially hired by.

*Note: Payment of the training invoice must be received before login information will be sent to the candidate.

Continuing Professional Education (CPE) Hours

P2PE candidate is required to submit proof of information systems assessment training within the last 12 months to support professional certifications of a minimum 20 Continuing Professional Education (CPE) hours per year and 120 Continuing Professional Education (CPE) hours over a rolling three year period.

  • Training provided by PCI SSC will count towards the annual CPE hours.
  • New QSA P2PE training is granted 12 CPE hours.
  • New PA-QSA P2PE training is granted 4 CPE hours.
  • These must be included in the CPE report sent to the PCI SSC. They will not be added automatically.
  • Community Meetings  2011-2012 are worth 4 CPE hours; 2013- to present are worth 12 hours.
  • Refer to the Maintenance Guide for further information on activities that qualify.

For CPE hours please submit the following information and CPE hours using the CPE form to coordinator@pcisecuritystandards.org:

  • Name
  • Title or Name of Program/Course
  • Date(s)
  • CPE Hours Earned (Click here for information on how to calculate CPE hours)

Any requalification training request sent without the P2PEs CPE hours for the past 12 months will not be processed.

Right for you?

You are a current Qualified Security Assessor who is employed by a QSA company performing assessments of third-party Point-to-Point Encryption applications and solutions. Typical job titles include: IT Security Auditor, Payment System Security, Auditor & Information Risk Consultant, Security Consultant.
Request More Information

Download Case Studies

View IPS-Paul Smith Case Study
View Bluefin-Hillman Case Study

Our website uses both essential and non-essential cookies (further described in our Privacy Policy) to analyze use of our products and services. By clicking “ACCEPT” below, you are agreeing to our use of non-essential cookies to provide third parties with information about your usage and activities. If you click “DECLINE” below, we will continue to use essential cookies for the operation of the website.

Powered by Translations.com GlobalLink OneLink SoftwarePowered By OneLink