- What You're Actually Preparing For
- Exam Format, Eligibility and Fee Mechanics
- The Seven Exam Topic Headings, One by One
- Handling the PA-DSS Heading in 2026
- What the Workshop Adds: Preparation Subjects
- A Six-Week Schedule Built Around the Topic List
- Who Benefits From the Credential
- Approaching 50 Questions in 60 Minutes
- Frequently Asked Questions
- The Developer exam has 50 questions, a 60-minute limit and a 62% passing score, not the 66% base CPISI mark.
- SISA publishes seven exam topic headings without official percentage weights, so study all seven rather than guessing priorities.
- Eligibility includes a 16-hour workshop or equivalent formal training; the one-year experience route needs issuer clarification.
- The heading "PA-DSS and S3 Standards" stays as published, even though PCI SSC retired PA-DSS on October 28, 2022.
What You're Actually Preparing For
The Certified Payment Industry Security Implementer - Developer, abbreviated CPISI-D, is issued by SISA. It is a developer-focused credential, separate from the base CPISI and from CPISI Advanced. That separation matters for your preparation, because several rules you may have read about the base certification, including its pass mark, do not carry over. If you want the fundamentals of what the credential represents before committing to a plan, start with our explainer on what CPISI-D is.
The credential targets people who build and maintain software that touches payment data. Its seven published topics move from the business context of the payment industry, through secure design and the relevant standards, to hands-on coding weaknesses and threat modelling. This article is the central study plan; for deeper treatment of each topic, pair it with the complete guide to all 7 content areas.
Exam Format, Eligibility and Fee Mechanics
The numbers that define your test
| Item | CPISI-D (Developer) |
|---|---|
| Questions | 50 |
| Time allowed | 60 minutes |
| Passing score | 62% |
| Published topic headings | 7, unweighted |
| Separate practical exam | None established; workshop exercises are not a timed or scored practical |
At 62%, you need 31 of 50 questions correct if each question counts equally, which is the straightforward reading of the published figures. With roughly 72 seconds per question on average, you have time to think but not to agonize. For a closer look at the threshold itself, see exactly what you need to pass.
Ways to qualify
SISA lists eligibility alternatives. The verified ones are SISA's 16-hour CPISI-D workshop, or equivalent formal training of at least 16 hours that covers the blueprint topics. SISA also displays a route based on a minimum of one year of verifiable full-time experience, but it refers to qualifying areas without spelling them out. Do not assume that any developer experience counts. If you plan to rely on experience rather than training, contact the issuer and get written clarification before paying. Our requirements breakdown walks through the qualification question in more detail.
The two-day live-online workshop is a training offering. It is not the examination duration, and it is not a verified exam-delivery arrangement, so do not confuse the two when planning your calendar.
What it costs
| Store option | Listed price |
|---|---|
| Certification only (includes application) | $199 |
| Training plus certification | $449 |
| Training only | $430 |
| Super bundle (includes one retake) | $500 |
Two cautions apply. First, the store shows dollar notation without an explicit currency code, so confirm what currency checkout actually charges before you budget in USD. Second, additional convenience charges are nonrefundable. If you are uncertain you will pass on the first attempt, the bundle with a retake is worth weighing against the certification-only price. The full comparison lives in our pricing breakdown.
The Seven Exam Topic Headings, One by One
Because no weights are published, a sound strategy is breadth first, then depth on whichever heading you find weakest. Below is how to think about each heading using the exact names SISA uses.
Domain 1: Background of Payment Industry
This is the context layer. Questions here test whether you understand who participates in a card transaction and why security obligations land where they do.
- Know the roles in the payment ecosystem and how cardholder data moves between them.
- Be able to explain why payment applications are attractive targets.
- Learn the vocabulary early, since later domains assume it.
Domain 2: Security By Design
Expect questions about building security into the lifecycle rather than bolting it on after release.
- Understand secure development practices across requirements, design, coding, testing and release.
- Be ready to identify which design decision reduces risk for a given scenario.
- Connect design principles to concrete controls such as least privilege and defense in depth.
Domain 3: PA-DSS and S3 Standards
This heading covers the software-security standards lineage. See the dedicated terminology section below for how to handle it in 2026.
- Learn what the standards aim to achieve for payment software.
- Understand the relationship between legacy and current software security frameworks.
- Study the PCI-SSF emphasis that SISA's current workshop curriculum highlights.
Domain 4: Payment Card Industry Security Standards
The broader PCI standards landscape and how developers' responsibilities fit within it.
- Know which requirements most directly affect application code and configuration.
- Understand the protection expected for stored and transmitted cardholder data.
- Be able to distinguish developer responsibilities from operational and organizational ones.
Domain 5: OWASP Web and Mobile Security
A hands-on heading where developers usually feel most at home, and where overconfidence can cost points.
- Review the major web application risk categories and their mitigations.
- Cover mobile-specific concerns such as insecure local storage and weak transport protection.
- Practice recognizing a vulnerability from a short description of its behavior.
Domain 6: Common Coding Vulnerabilities
Pattern recognition at the code level: injection flaws, broken authentication, poor input handling, and similar recurring mistakes.
- Know why each flaw occurs and the standard remediation.
- Be able to pick the secure alternative from several plausible-looking options.
- Pay attention to error handling and logging mistakes that leak sensitive data.
Domain 7: Threat Modelling
A structured way of identifying what can go wrong before it does.
- Understand the steps of a threat model: scope the system, map data flows, identify threats, decide mitigations.
- Practice applying a model to a payment flow such as checkout or tokenized storage.
- Be able to match a threat to the control that addresses it.
Handling the PA-DSS Heading in 2026
This is the single most confusing part of the topic list, so it deserves its own section. SISA's exam topic is titled PA-DSS and S3 Standards. Yet the PCI Security Standards Council states that PA-DSS retired on October 28, 2022. Meanwhile, SISA's current workshop curriculum emphasizes PCI-SSF and OWASP.
The practical takeaway is to learn the standards as a progression rather than memorizing one era in isolation. A candidate who understands why the framework changed will handle either phrasing; one who memorized only the old name may be thrown by a question written with the newer terms.
What the Workshop Adds: Preparation Subjects
SISA's workshop page publishes a set of preparation subjects: cryptography and key management, hashing and tokenization, application authorization and access control, audit logging, OWASP web and mobile security, and secure deployment and production support. These are useful background and a sensible way to deepen your technical grounding.
However, they are preparation subjects, not additional exam domains. They do not add official weights and they do not prove the exam covers each one exhaustively. Use them as supporting study, especially because they feed naturally into Domains 2, 4, 5 and 6, but do not let them displace time from the seven official headings.
- Cryptography and key management: Know why keys must be protected and rotated, and what weak cryptographic choices look like in code.
- Hashing and tokenization: Understand how each reduces exposure of sensitive data and where each is appropriate.
- Authorization and access control: Review how to enforce permissions server-side rather than trusting the client.
- Audit logging: Know what to log, and equally what must never appear in logs.
- Secure deployment and production support: Learn how configuration, secrets handling and support access can undo good code.
A Six-Week Schedule Built Around the Topic List
This is the only generic-method section in the article, and it is tied directly to the seven headings. Adjust the pace to your background: a working application security engineer may compress it, while someone new to payments should keep every week.
Domain 1 and the standards landscape
- Learn the payment ecosystem and vocabulary first, since everything else builds on it.
- Skim Domain 4 to see which PCI requirements touch developers.
Domain 2: Security By Design
- Map secure lifecycle practices to the phases of your own projects.
- Begin reading about cryptography and key management as supporting material.
Domains 3 and 4: standards in depth
- Study the PA-DSS to PCI-SSF progression and keep the official heading intact in your notes.
- Work through PCI requirements relevant to stored and transmitted cardholder data.
Domains 5 and 6: OWASP and coding flaws
- Review web and mobile risk categories, then pair each with its code-level fix.
- Practice identifying vulnerable snippets and choosing the secure replacement.
Domain 7: Threat Modelling
- Model a payment flow end to end and list threats and mitigations.
- Revisit weak areas from earlier weeks.
Timed practice and review
- Take full-length attempts of 50 questions in 60 minutes using the CPISI-D practice tests.
- Target any heading where you consistently miss questions.
The reasoning behind the order: context and design come first because they frame the standards; standards come before OWASP and coding flaws so you can tie each technical weakness to a compliance expectation; threat modelling comes late because it draws on everything before it. Our one-page cheat sheet is a handy companion for the final review week.
Who Benefits From the Credential
The Developer track suits people whose daily work involves writing, reviewing or securing payment-related software: application developers, secure coding reviewers, application security engineers, and technical leads responsible for payment features. Teams at payment processors, fintech firms, banks and software vendors that handle card data are natural employers, because customers and auditors increasingly expect demonstrable secure development knowledge.
Be realistic about what a credential does. It signals structured knowledge of payment security and secure coding, which can strengthen a profile when you apply to security-focused development roles, but it does not substitute for experience. For a view of roles that mention the credential, see our overview of CPISI-D jobs, and for a broader value assessment read whether the certification is worth it. We deliberately avoid quoting salary figures here because no verified figure exists to cite.
Approaching 50 Questions in 60 Minutes
Pacing
With 60 minutes for 50 questions, do a first pass answering what you know quickly, flag the uncertain ones, then return. Because the pass mark is 62%, you can afford to miss a meaningful number of questions; do not burn five minutes on one stubborn item.
Reading scenario questions
Questions on coding vulnerabilities and threat modelling often describe a situation and ask for the best control. Identify the asset at risk, the likely threat, and then choose the mitigation that addresses the root cause rather than a symptom. Be wary of options that sound secure but only partially fix the problem.
Key Takeaway
Because there are no official weights, avoid over-investing in the topics you already enjoy. Rotate through all seven headings, then spend your remaining time on the one where practice scores are lowest.
A note on difficulty: how hard you find it depends heavily on your background in payments and secure coding. For a candid discussion, read how hard the CPISI-D exam is. We also have no verified pass-rate data to share, so be skeptical of any source quoting one.
Frequently Asked Questions
The Developer exam has 50 questions with a 60-minute time limit. The passing score is 62%. Do not confuse this with the base CPISI pass mark of 66%, which applies to a different credential.
SISA publishes seven topic headings without official percentage weights, and the blueprint label does not link to a retrievable file. Any source quoting exact domain percentages is not drawing on a published SISA breakdown, so study all seven headings.
PCI SSC states PA-DSS retired on October 28, 2022, and SISA's workshop emphasizes PCI-SSF and OWASP. The exam heading is still published as "PA-DSS and S3 Standards," so keep the official name and also learn the transition to current frameworks.
The certification-only option is listed at $199 and includes the application. That assumes you already meet an eligibility route, such as completing qualifying formal training of at least 16 hours. Confirm the checkout currency and note that convenience charges are nonrefundable.
SISA displays a route requiring at least one year of verifiable full-time experience, but it refers to qualifying areas without listing them. Contact the issuer for clarification rather than assuming that all developer experience qualifies. For other questions about the credential, see what CPISI-D stands for and our certification overview.