Customer utilizes a third-party email phish platform to test employee awareness and provide training regarding email phishing attempts.  PCI DSS 9.9.3, PCI DSS 12.6.1, NIST 3.2.3