3.6.1.1Cryptographic keys used to protect stored account data are secured

Defined Approach Requirements:

Additional requirements for service providers only: A documented description of the cryptographic architecture is maintained that includes:

- Details of all algorithms, protocols, and keys used for the protection of stored account data, including key strength and expiry date.

- Preventing the use of the same cryptographic keys in production and test environments. This bullet is a best practice until its effective date; refer to applicability notes below for details.

- Description of the key usage for each key.

- Inventory of any hardware security modules (HSMs), key management systems (KMS), and other secure cryptographic devices (SCDs) used for key management, including type and location of devices, as outlined in Requirement 12.3.4.

Defined Approach Testing Procedures:

3.6.1.1 Additional testing procedure for service provider assessments only: Interview responsible personnel and examine documentation to verify that a document exists to describe the cryptographic architecture that includes all elements specified in this requirement.