What Is CPISI-D?

What the Credential Actually Is

CPISI-D stands for Certified Payment Industry Security Implementer - Developer. It is a developer-focused certification from SISA, built around the idea that the people who write payment application code are the ones who decide, line by line, whether cardholder data stays protected. Where many payment security credentials speak to auditors, assessors, and compliance managers, this one speaks to the engineer holding the keyboard.

If you have seen the acronym elsewhere, be careful. This article covers only the SISA Developer credential. For other angles on the name itself, see our explainers on what CPISI-D stands for and the broader CPISI-D certification overview.

Who Issues It and Where It Sits in the SISA Family

The credential is issued by SISA through its SISA Institute training and certification arm. SISA positions the Developer credential as a distinct certification, separate from the base CPISI and from CPISI Advanced. That separation is more than branding. The Developer exam has its own question count, its own time limit, and its own passing mark, so none of the base CPISI parameters can be assumed to carry over.

The practical consequence for candidates: do not borrow numbers from forum posts about other SISA exams. The Developer passing score is 62%, and the base CPISI mark is different. If you are comparing the two tracks, treat them as two separate exams that happen to share a family name.

Exam Format at a Glance

Fifty questions in sixty minutes works out to a little over a minute per question. That pace rewards candidates who recognize concepts quickly rather than reasoning from scratch every time. At a 62% threshold, you need a bit over thirty correct answers out of fifty, so a handful of weak topics will not necessarily sink you, but a blind spot across a whole topic area can. For a deeper look at the arithmetic, read our guide to the CPISI-D passing score and our difficulty breakdown.

The Seven Exam Topics

SISA's current certification page lists seven exam topics. They are published as headings only: no percentage weights, no sub-objectives, and no version label. The page's "Exam Blueprint" label does not point to a retrievable file, so any claim about how many questions come from each topic would be invention. What follows is what each heading plausibly asks a developer to know, framed as study direction rather than a claimed blueprint. For a topic-by-topic walkthrough, see our CPISI-D exam domains guide.

The PA-DSS Heading and Why It Still Appears

The third topic is titled PA-DSS and S3 Standards, and this is the one that confuses careful readers. The PCI Security Standards Council states that PA-DSS retired on October 28, 2022. Yet SISA's exam topic list still carries the heading in that form.

Both facts can be true at once. SISA's current workshop curriculum emphasizes PCI-SSF (the Software Security Framework family) and OWASP, which reflects where the industry has moved. But the exam heading is the issuer's wording, and a legacy label on an exam topic does not authorize anyone to rename it. Treat the heading as published, and when you study, learn both the retired standard's role and the current framework that supersedes it.

Preparation Subjects Beyond the Topic List

Separately from the exam topics, SISA's published workshop coverage names several preparation subjects: cryptography and key management, hashing and tokenization, application authorization and access control, audit logging, OWASP web and mobile security, and secure deployment and production support. These are valuable for any developer working on payment code, and they overlap naturally with several exam topics.

One caution: these preparation subjects do not add official exam domains, do not establish weights, and do not prove that the exam covers each of them exhaustively. Use them to deepen your practical grounding, but organize your study around the seven published topics. Our CPISI-D study guide shows one way to combine the two.

Eligibility Routes

SISA presents more than one way to qualify to sit the exam:

1. SISA's 16-hour CPISI-D workshop. The straightforward route, delivered as the two-day live-online course.
2. Equivalent formal training. Training of at least 16 hours that covers the blueprint topics.
3. Experience. SISA displays a route based on a minimum of one year of verifiable full-time experience.

Pricing and Purchase Options

SISA's training and certification store lists four options:

Two details are easy to miss. First, additional convenience charges are nonrefundable. Second, the store uses dollar notation without an explicit currency code, so confirm the checkout currency before assuming these are US dollars. Note too how the numbers interact: training-plus-certification costs only $19 more than training alone, which makes the bundle the natural pick for anyone who needs the workshop anyway. The super bundle's value is the included retake, which matters most if you expect the 50-question pace to be a challenge. For a full cost analysis, see our CPISI-D certification cost breakdown.

Who Benefits From This Credential

The Developer designation is aimed at people who build and maintain software that touches payment data. Typical fits include:

• Application developers working on payment gateways, checkout flows, or card-handling services
• Mobile developers shipping wallet or in-app payment features
• Engineers responsible for secure deployment and production support of payment systems
• Technical leads who review code and architecture for security and PCI alignment

Employers that hire for these roles include payment processors, fintech companies, banks with in-house development teams, and consultancies serving regulated clients. SISA lists recommended job roles on its pages, but the exact list should be checked there rather than assumed. If you are weighing the career value, our ROI analysis and CPISI-D jobs article explore that question, and no specific salary figures are claimed here.

Sequencing Your Preparation Around the Topics

Because the seven topics build on each other, order matters more than intensity. One sensible arrangement:

The logic: standards and design vocabulary come before vulnerabilities so you understand why a control exists, and threat modelling comes last because it asks you to combine every earlier topic. Finish with full-length timed practice using the CPISI-D practice tests so the 62% threshold feels familiar before exam day, and keep our cheat sheet handy for last-minute review.

What Is Not Publicly Verified

Honest preparation includes knowing what you cannot know. As of SISA's current pages:

• Topic weights are not published, so you cannot prioritize by percentage.
• A detailed blueprint beyond the seven headings is not retrievable.
• Renewal intervals and CPE requirements for the Developer credential remain unverified, and the base CPISI renewal rules should not be applied to it.
• Pass rates are not published by the issuer, so any figure you encounter should be treated skeptically. See what the data actually shows.
• Exam dates and scheduling specifics should be confirmed with SISA directly; our exam dates guide explains what to check.

Because the topic list is also undated and unversioned, check SISA's certification page again shortly before you register, in case the wording has changed.

Frequently Asked Questions