3.6.1.2Cryptographic keys used to protect stored account data are secured

Defined Approach Requirements:

Secret and private keys used to encrypt and decrypt stored account data are stored in one (or more) of the following forms at all times:

- Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key.

- Within a secure cryptographic device (SCD), such as a hardware security module (HSM) or PTS-approved point-of-interaction device.

- As at least two full-length key components or key shares, in accordance with an industry-accepted method.

Defined Approach Testing Procedures:

3.6.1.2.a Examine documented procedures to verify it is defined that cryptographic keys used to encrypt/decrypt stored account data must exist only in one (or more) of the forms specified in this requirement.

3.6.1.2.b Examine system configurations and key storage locations to verify that cryptographic keys used to encrypt/decrypt stored account data exist in one (or more) of the forms specified in this requirement.

3.6.1.2.c Wherever key-encrypting keys are used, examine system configurations and key storage locations to verify:

- Key-encrypting keys are at least as strong as the data-encrypting keys they protect.

- Key-encrypting keys are stored separately from data-encrypting keys.