W/ FACULTY · WACK-FACULTY-0001 · PUBLIC PILOT

DON'T TEACH THE ANSWER.
TEACH THE REASONING THAT SURVIVES IT.

Use one fictional payment case across three class periods. Students learn to narrate behavior, separate authority, connect claims to proof, disclose uncertainty, and defend what a change reopens.

W/✓
Program authority statePractitioner reviewed / 2026-09-16
Download the teaching pack Open session one
TEACHING STUDIO
ONE CASE / THREE SESSIONS
FICTIONAL CASEThe Alumni Donation Page

Hosted form · public callback · scripts · identity · refunds · evidence

  1. 01
    BEHAVIORWhat actually happens?
    narrative + map
  2. 02
    AUTHORITYWho can say what?
    claim + proof
  3. 03
    CHANGEWhat must reopen?
    defense + retest
GRADEREASONING≠COMPLIANCE

Teach safely. Attribute deliberately.

W/ Faculty is independent practitioner education and a public pilot. It is not PCI SSC guidance or official PCI SSC training. It is not an accredited curriculum, a certification program, an assessor qualification, an eligibility decision, a grading mandate, or a compliance result. It is not a PCI DSS assessment and does not substitute for assessor judgment, organizational policy, or compliance-accepting-entity direction. Use only fictional or explicitly sanitized environments. Never enter account data, credentials, provider secrets, client evidence, restricted architecture, student records, or targets the class is not authorized to test.

The W/ Faculty method

Five teaching moves before the model answer.

The instructor designs the reasoning path, authority boundary, and grading contract before writing the response learners are expected to defend.

  1. W/?01

    Stage the facts

    Give learners enough architecture, behavior, ownership, time, and source context to reason—without hiding the uncertainty that makes the case worth teaching.

    A bounded fictional case with declared facts, unknowns, non-claims, and prohibited assumptions
  2. W/→02

    Ask for relationships

    Require students to connect people, systems, providers, identities, data, tests, evidence, and change instead of reciting isolated requirement language.

    A question sequence that makes the payment story traversable
  3. W/↔03

    Separate authority

    Keep published PCI DSS text, program direction, organization assertions, assessor judgment, practitioner method, and student analysis visibly distinct.

    An answer key that labels the authority of every material statement
  4. W/!04

    Grade the reasoning

    Evaluate completeness, traceability, source use, uncertainty, and change impact—not whether a learner guessed the instructor's preferred scope conclusion.

    A six-dimension analytic rubric with no compliance score
  5. W/✓05

    Debrief the boundary

    End with what the class established, what remains unresolved, who would have authority in a real engagement, and which changed fact would reopen the work.

    A bounded debrief and one retestable course improvement

Cumulative fictional case / CAMPUS-LAB-03

One case gets deeper. It does not become more certain.

Download case brief

A fictional university embeds a provider-hosted donation form in a university-managed site. The university controls DNS, page templates, analytics, scripts, developer access, deployment, a provider callback, refund operations, and the evidence retained for review.

Declared facts

  • The provider-hosted form receives the donor's payment account data.
  • University-managed code and third-party scripts execute on the surrounding page.
  • A public callback records transaction status in a university application.
  • Workforce and cloud identities administer the site, callback, logging, and deployment pipeline.
  • Refunds begin in a university operations workflow and continue in the provider service.
  • The course provides no validation instrument decision, segmentation result, provider responsibility conclusion, or compliance status.

Productive unknowns

  • Which exact provider service and integration mode are in use?
  • What data is returned through the callback?
  • Which scripts can affect the payment-page experience?
  • What current provider assurance and responsibility statements apply?
  • Which public terminations, address populations, and application behaviors require testing?
  • Which authority will accept the final validation response?

Three complete class periods

Every artifact becomes evidence for the next lesson.

Seventy-five minutes each. One case. No compliance score.

0175 MIN

Tell the Payment Story Before Naming the Requirement

Students can reconstruct normal, failure, retry, refund, support, administrative, and provider-callback behavior from bounded facts.

The form is hosted. What, exactly, did the university stop owning?
Do
Teams build a behavior narrative and two-path relationship map: account-data movement and security influence.
Ship
A one-page payment narrative plus an annotated relationship map.
Surface
The system that receives the card data is the only system worth drawing.
Stop
Stop any team that draws a scope circle before it can narrate the alternate and administrative paths.
Name one component that may never receive account data but can still change the security of the payment journey.Download lesson plan
0275 MIN

Turn Assertions Into Attributable Claims

Students can distinguish observed facts, documented statements, asserted interpretations, validated results, and unresolved questions.

The provider says it is compliant. Which university claim did that sentence actually prove?
Do
Teams classify statements by authority and reconcile Expected, Observed, Documented, Asserted, and Validated states.
Ship
A claim-evidence-authority matrix with explicit non-claims and unresolved contradictions.
Surface
A source with more institutional authority automatically proves every implementation claim.
Stop
Stop any answer that uses assessor judgment, provider assurance, or a dashboard result without naming its subject and limitation.
Rewrite one absolute conclusion as a bounded claim that identifies subject, period, source, and authority.Download lesson plan
0375 MIN

Change One Fact and Defend What Reopens

Students can propagate one architecture change into affected inventory, ownership, testing, evidence, and assessment claims.

The callback moved behind a new gateway. Which old evidence is still allowed to speak?
Do
Each team receives one change card, revises its prior artifacts, and delivers a five-minute bounded defense to a cold-reader panel.
Ship
A change-impact record, revised claims, test propositions, and a bounded disposition.
Surface
A technically successful deployment preserves the truth of the prior assessment story.
Stop
Stop any team that marks the change complete while a dependent artifact still describes the prior architecture.
State the smallest new fact that would reopen your conclusion tomorrow.Download lesson plan

Analytic reasoning rubric

A better answer is easier to reconstruct—not louder.

Download rubric
1

Emerging

Names isolated facts or conclusions but leaves the reasoning path mostly implicit.

2

Visible

Makes the main facts and artifacts visible but leaves important joins or limitations unexplained.

3

Connected

Connects facts, sources, owners, tests, and evidence with bounded reasoning and explicit uncertainty.

4

Defensible

A cold reader can reproduce the reasoning, locate its authority, see its limits, and identify what reopens it.

FACULTY-RUBRIC-01

Behavior coverage

Does the work cover normal, alternate, failure, refund, support, and administrative behavior rather than only the happy path?

Do not grade: Do not award certainty merely because the diagram is visually polished.
FACULTY-RUBRIC-02

Relationship quality

Are account-data, connectivity, security influence, administration, provider, and change relationships explicit?

Do not grade: Do not reward a scope circle that hides why components were included or excluded.
FACULTY-RUBRIC-03

Authority discipline

Can the reader tell which statements come from published sources, organization assertions, assessor judgment, practitioner method, or student analysis?

Do not grade: Do not let citation count substitute for correct authority or applicability.
FACULTY-RUBRIC-04

Claim-to-proof fit

Does each cited artifact or test actually support the bounded subject, period, population, and proposition claimed?

Do not grade: Do not treat screenshots, reports, dashboards, or provider documents as self-authenticating.
FACULTY-RUBRIC-05

Uncertainty disclosure

Are assumptions, missing facts, contradictions, non-claims, and stopping points visible?

Do not grade: Do not punish a learner for refusing to invent a fact the case does not provide.
FACULTY-RUBRIC-06

Change propagation

When one fact changes, does the learner reopen every affected narrative, inventory, owner, test, evidence object, and claim?

Do not grade: Do not accept a change ticket as proof that dependent records remain current.

Instructor answer boundary

The instructor owns the learning contract—not the real-world conclusion.

Download answer boundary
01
INSTRUCTOR MAY

Evaluate whether the learner used the provided facts completely and consistently.

INSTRUCTOR MAY NOT

Present the fictional case answer as a scope decision for another environment.

02
INSTRUCTOR MAY

Require every claim to identify its source, subject, period, authority, and limitation.

INSTRUCTOR MAY NOT

Convert practitioner analysis into PCI SSC language or organizational policy.

03
INSTRUCTOR MAY

Grade traceability, reasoning, uncertainty, and internal consistency.

INSTRUCTOR MAY NOT

Grade a PCI DSS compliance result, SAQ eligibility decision, or compliance-accepting-entity determination.

04
INSTRUCTOR MAY

Use published PCI SSC material and clearly attributed practitioner methods as distinct teaching sources.

INSTRUCTOR MAY NOT

Imply endorsement, official training, accreditation, assessor qualification, or employment readiness.

05
INSTRUCTOR MAY

Ask students to propose authorized tests against fictional or explicitly sanctioned lab systems.

INSTRUCTOR MAY NOT

Authorize scanning, exploitation, provider testing, or access to systems the course does not own.

06
INSTRUCTOR MAY

Accept multiple defensible answers when the case facts support them and limitations remain explicit.

INSTRUCTOR MAY NOT

Hide a missing fact so that only the instructor's preferred answer can appear correct.

Five misconception interventions

Do not correct the learner. Improve the question.

Each card turns a familiar shortcut into a reasoning move the learner must make visible.

FACULTY-INTERVENTION-01
“The provider handles PCI.”

Which exact service activity does the provider perform, what remains with the customer, and which current source supports that boundary?

The learner replaces a provider slogan with a service-specific responsibility claim.
FACULTY-INTERVENTION-02
“It is out of scope.”

Show the relationship, the exclusion basis, the test or evidence, the responsible authority, and the fact that would reopen the conclusion.

The learner turns a label into a bounded, testable proposition.
FACULTY-INTERVENTION-03
“The screenshot proves it.”

What subject, source, population, clock, collector, method, sequence, and limitation travel with that image?

The learner distinguishes a usable capture from sufficient evidence.
FACULTY-INTERVENTION-04
“The penetration test passed.”

Which proposition, target population, material variants, environment, technique, exclusions, and retests did the methodology cover?

The learner evaluates the test design rather than repeating the report outcome.
FACULTY-INTERVENTION-05
“That is the correct answer.”

Which facts and authority make it correct here, what remains unresolved, and which changed fact would make it incorrect?

The learner can defend the answer without borrowing the instructor's authority.

Eight portable faculty records

Make the course explain itself, too.

Editable Markdown keeps the teaching decisions attributable, reviewable, and easy to revise after a pilot.

01FACULTY-KIT-01

Course Authority Map

Label what each course source is allowed to say.

Download record
02FACULTY-KIT-02

Fictional Case Fact Sheet

Create a fair case without leaking the answer.

Download record
03FACULTY-KIT-03

Three Session Lesson Spine

Sequence behavior, claims, and change as cumulative reasoning.

Download record
04FACULTY-KIT-04

Question Ladder

Move from observation to bounded conclusion without answering for the learner.

Download record
05FACULTY-KIT-05

Analytic Rubric Record

Grade reasoning quality without scoring compliance.

Download record
06FACULTY-KIT-06

Answer Boundary Sheet

Define what instructors may evaluate and what remains outside classroom authority.

Download record
07FACULTY-KIT-07

Intervention and Debrief Log

Capture where oral rescue was needed and turn it into a course repair.

Download record
08FACULTY-KIT-08

Safe Assignment Release Checklist

Keep course materials fictional, attributable, accessible, and reusable.

Download record

Ten reviewed readings

The teaching studio composes the library. It does not rewrite it.

Every technical reading already carries a digest-current named practitioner approval. The W/ Faculty program remains independently reviewable.

01WACK-CONTENT-0154

PCI DSS Is Not Just a Checklist. Learn to Tell the Payment Story.

A student can memorize twelve requirement families and still be unable to explain how a payment moves, who can affect it, or what evidence supports a claim.

Practitioner reviewed / 2026-09-15
02WACK-CONTENT-0155

What Actually Happens When Someone Taps a Card?

A tap lasts seconds. The system story around it can include a reader, terminal, application, network, acquirer, processor, issuer, keys, identities, logs, settlement, refund, and support paths.

Practitioner reviewed / 2026-09-15
03WACK-CONTENT-0156

Scope Is a Relationship Problem, Not a Circle on a Diagram

A neat boundary can conceal the very connections, administrative paths, and security influence that determine whether the boundary is defensible.

Practitioner reviewed / 2026-09-15
04WACK-CONTENT-0157

Evidence Is a Claim With Receipts

A screenshot is not self-explanatory. Without subject, time, source, population, method, and custody, it can be visually persuasive and evidentially weak.

Practitioner reviewed / 2026-09-15
05WACK-CONTENT-0158

The Provider Is Compliant. Your Architecture Still Needs an Explanation.

A service-provider assertion can support a responsibility claim. It cannot draw the customer's architecture, configure the service, or prove every customer duty occurred.

Practitioner reviewed / 2026-09-15
06WACK-CONTENT-0161

How to Read a PCI DSS Requirement Without Memorizing It

Memorized requirement numbers fade. A disciplined reading method survives version changes, unfamiliar systems, and difficult evidence.

Practitioner reviewed / 2026-09-15
07WACK-CONTENT-0162

Build a Payment-Security Portfolio Without Touching Real Card Data

A strong early-career portfolio shows reasoning, source discipline, communication, and safe boundaries—not unauthorized access to a real payment environment.

Practitioner reviewed / 2026-09-15
08WACK-CONTENT-0129

Expected vs. Observed vs. Documented vs. Asserted vs. Validated

Five columns. One control. If they are all green, there is a fair chance somebody collapsed five different questions into one status.

Practitioner reviewed / 2026-09-10
09WACK-CONTENT-0140

Design the Payment Boundary Before Product Launch

The cheapest PCI scope reduction happens while the payment architecture is still erasable. After launch, every shortcut acquires customers, evidence obligations, rollback anxiety, and somebody prepared to call it indispensable.

Practitioner reviewed / 2026-09-13
10WACK-CONTENT-0120

What Is Your Data-Flow Narrative?

A data-flow diagram gives account data a route. A data-flow narrative gives every route a transaction, condition, data state, owner, and consequence. If the arrow cannot be spoken as a complete testable sentence, it may be decoration.

Practitioner reviewed / 2026-09-09

Faculty development session

Build One Teachable Payment-Security Module

One bounded fictional case, one three-session sequence, one analytic rubric, one authority-aware answer key, and one observation plan ready for a small classroom pilot.

90-minute studio guide Canonical JSON
  1. Fifteen minutes: declare the learner, course context, prerequisite knowledge, and prohibited data or testing.
  2. Fifteen minutes: bound one fictional payment case into facts, productive unknowns, non-claims, and a later change.
  3. Fifteen minutes: sequence behavior, authority, claim-to-proof, and change reasoning across three sessions.
  4. Fifteen minutes: build the rubric and answer boundary before writing the model response.
  5. Fifteen minutes: rehearse five tempting student answers using intervention cards instead of corrective lectures.
  6. Fifteen minutes: define the first-fracture observation, smallest repair, and cold-reader retest.
Search