PCI Council Cuts Its QIR Program Fee And Shortens Training Time

The PCI Security Standards Council is making changes to its qualified integrators and resellers certification program by reducing the fee to $100, making the certification an individual one, and shortening the training-course time, the council announced Wednesday.

Launched in 2012, the QIR program’s focus has been on improving payments security for point-of-sale software, specifically poor practices with remote access to payment systems that have resulted in a large, perhaps dominant, portion of data breaches affecting smaller merchant systems.

Among the changes is new training-course content to address insecure remote access, weak password practices, and outdated and unpatched software during a payment-system installation. “The revised QIR program will focus heavily on these three critical security-control areas to better mitigate merchant risk,” Gill Woodcock, senior director of certification programs for the Council, said in a blog post.

The updated course takes approximately one and a half to two (1.5-2) hours and concludes with a 30-question multiple-choice exam.

“The Council’s goal is to train as many security professionals as possible to install payment systems properly and in a secure manner,” she said. “To achieve this, we are making changes to the program to reduce barriers for professionals to become QIRs, particularly smaller integrators and resellers in order to increase the program’s reach to small businesses. The changes are designed to increase the number of trained integrators and resellers available to merchants, and to ensure that these integrators and resellers are trained specifically in the three most common causes of data breaches.”

She noted that the shift from a company-based certification to an individual one frees up the QIR-certified professional to use that expertise regardless of the employer, as long as he remains qualified under the program.

Lowering the cost should help, too, she said. The previous fee was $395 per person or $250 if the employer was a participating organization in the PCI Council. Requalification also moves to an annual cycle instead of a three-year cycle.

The PCI Council previewed the changes in the QIR program in December.