CPISI-D Requirements 2026: Eligibility, Prerequisites & How to Qualify

What Actually Qualifies You for the CPISI-D

The Certified Payment Industry Security Implementer - Developer (CPISI-D) is SISA's credential for people who build payment software and need to prove they can build it securely. It is a separate certification from the base CPISI and from CPISI Advanced, which matters more than it sounds. Eligibility rules, passing marks, and renewal terms for those credentials do not automatically carry over to the Developer track. If you read a forum post that quotes a pass mark or a prerequisite, check which CPISI variant it describes before trusting it.

On SISA's current certification page, there are two eligibility alternatives. The first is training: complete SISA's 16-hour CPISI-D workshop, or equivalent formal training of at least 16 hours that covers the blueprint topics. The second is experience: a minimum of one year of verifiable full-time experience. The first route is clean and well defined. The second is displayed but incomplete, and that gap is covered in detail below.

If you want the broader picture of what the credential is before digging into requirements, start with What Is CPISI-D Certification? and then return here for the qualification mechanics.

The Training Route: 16 Hours of Formal Instruction

The most defensible way to qualify is through training. SISA offers a CPISI-D workshop of 16 hours, and the training offering is described as a two-day live-online course. That format detail is worth separating from the exam itself: a two-day live-online workshop is a training delivery arrangement. It tells you nothing about how the exam is delivered or how long it runs.

What counts as equivalent training

SISA's wording allows for "equivalent formal training of at least 16 hours covering the blueprint topics." Two conditions are embedded there. The training must be formal, and it must cover the blueprint topics. A single conference talk or a self-directed reading list is unlikely to meet that bar. A structured secure-development course that spans PCI standards, OWASP material, common coding vulnerabilities, and threat modelling plausibly could, provided it totals at least 16 hours and you can document it.

Because the issuer does not publish a detailed list of accepted third-party providers, treat equivalence as something to confirm rather than assume. Keep your syllabus, attendance record, and completion certificate. If SISA asks you to demonstrate coverage, those documents are your evidence.

What the workshop emphasizes

SISA's published workshop curriculum emphasizes PCI-SSF and OWASP. It also lists preparation coverage of cryptography and key management, hashing and tokenization, application authorization and access control, audit logging, OWASP web and mobile security, and secure deployment and production support. These are useful preparation subjects, but they are not additional official exam domains and they do not establish weights. Think of them as the practical muscle behind the seven formal exam topics.

Training exercises and workshop hours also do not create a separate timed or scored practical exam. Nothing in the issuer's public materials describes a hands-on lab component that is graded as part of certification.

The Experience Route: What Is Verified and What Is Not

SISA's page displays a route based on a minimum of one year of verifiable full-time experience. Here is the problem: the page refers to qualifying areas for that experience and then does not list them. That leaves a real ambiguity, and the responsible response is to resolve it with the issuer, not to guess.

It is tempting to infer the qualifying areas from the recommended job roles listed elsewhere on SISA's materials, or to assume that any year of developer work counts. Neither inference is supported. A year writing front-end code for a retail site with no payment handling is not obviously the same as a year building or securing cardholder-data flows. Until SISA states the qualifying areas, you cannot know which side of the line your experience falls on.

If you cannot get a clear answer quickly, the training route is the safer choice. It removes interpretation from the equation and gives you structured exposure to the blueprint topics at the same time. For many working developers, the workshop is also the faster path to a well-organized mental map of the exam scope.

The Exam You Are Qualifying For

Eligibility only makes sense in light of what you are eligible to sit. The Developer examination is 50 questions in 60 minutes, with a passing score of 62%. That works out to roughly a minute and a few seconds per question, which rewards candidates who recognize concepts quickly over those who need to reason from first principles on each item.

For a deeper treatment of the scoring threshold, see CPISI-D Passing Score 2026: Exactly What You Need to Pass. If you are weighing how demanding the sitting is, How Hard Is the CPISI-D Exam? covers difficulty in more depth.

Registration Paths and Fee Mechanics

SISA's training and certification store lists several purchase options, and the one you choose interacts directly with how you meet eligibility. The listed prices use dollar notation without an explicit currency code, so confirm the currency at checkout before treating any figure as US dollars.

A few practical readings of that table. The certification-only option at $199 makes sense if you already have qualifying formal training or have confirmed that your experience qualifies. The $449 training-plus-certification bundle is the natural fit if you need the workshop to satisfy eligibility. The gap between $430 for training alone and $449 for training plus certification is small, so buying training alone and certification separately later rarely saves money. The $500 super bundle adds one retake, which is a form of insurance for a 50-question, 60-minute exam with a 62% bar.

Additional convenience charges are nonrefundable. Read the checkout summary line by line before paying. For a fuller financial picture, including how to think about total spend, see CPISI-D Certification Cost 2026: Complete Pricing Breakdown.

The Seven Exam Topics You Must Be Ready For

SISA's current certification page lists seven exam topics. They are published without weights, the list is unversioned, and the displayed Exam Blueprint label does not provide a retrievable linked file. That means you should not assume a percentage breakdown, and you should not assume hidden sub-headings beyond what the issuer lists. Study all seven with roughly balanced attention, adjusted for your own weak spots.

For a section-by-section walk through each area, read CPISI-D Exam Domains 2026: Complete Guide to All 7 Content Areas.

The PA-DSS Terminology Trap

One of the seven headings, "PA-DSS and S3 Standards," deserves its own warning. PCI Security Standards Council states that PA-DSS retired on October 28, 2022. Yet SISA's exam topic still carries the PA-DSS label, while its current workshop curriculum emphasizes PCI-SSF and OWASP.

The right way to handle this is to hold both facts at once. The retirement is a real fact about the PCI Council's standards landscape. The heading is also the real wording of SISA's exam topic. You do not get to rename the topic in your head and skip it, and you should not dismiss the older material as irrelevant either. Study the legacy framework as context, understand how newer secure software standards replaced it, and be prepared for questions that use SISA's terminology.

Who Should Apply and Who Hires for This Skill Set

The Developer credential is aimed at people who write, review, or maintain payment-related software. That includes application developers, mobile developers, and engineers on teams that handle cardholder data or integrate with payment gateways. Secure code reviewers and technical leads responsible for the security of a payment application also fit naturally.

Organizations that care about this skill set tend to be those that either build payment applications or process card data inside their own systems: payment solution vendors, fintech companies, banks and their technology partners, e-commerce platforms, and security consultancies that serve them. The credential signals that a developer understands PCI expectations and common vulnerability classes, which reduces the burden on security teams during assessments.

Be careful about reading too much into job-role lists. Roles recommended by an issuer indicate who the credential is aimed at; they do not define what experience counts toward eligibility. For market-facing questions, see CPISI-D Jobs, CPISI-D Salary Guide 2026, and Is the CPISI-D Certification Worth It? for a balanced view of return on investment.

A Qualification Plan Built Around the Topic List

Once you have decided on a route, sequence your preparation so the foundational topics come before the applied ones. Here is one way to lay out the weeks if you are using the workshop route and have a few weeks around it.

That ordering is deliberate: payment context and standards first, design principles next, then the code-level and threat-level material that builds on them. For a longer preparation framework, see the CPISI-D Study Guide 2026: How to Pass on Your First Attempt, and use the CPISI-D practice tests to check readiness against the 62% bar. A compact revision aid is available in the CPISI-D Cheat Sheet.

What this article cannot give you is renewal information. Exact Developer renewal intervals and CPE requirements remain unverified, and the base CPISI renewal rules should not be transplanted onto this credential. Before you pay, review SISA's certification policy page and confirm the current terms directly with the issuer.

Frequently Asked Questions