PCI DSS v4.0/Requirement 03: Protect Stored Account Data/46 of 250
3.6.1Cryptographic keys used to protect stored account data are secured
Control family: Requirement 03: Protect Stored Account Data
Control description
Defined Approach Requirements:
These procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include:
- Access to keys is restricted to the fewest number of custodians necessary.
- Key-encrypting keys are at least as strong as the data-encrypting keys they protect.
- Key-encrypting keys are stored separately from data-encrypting keys.
- Keys are stored securely in the fewest possible locations and forms.
Defined Approach Testing Procedures:
3.6.1 Examine documented key-management policies and procedures to verify that processes to protect cryptographic keys used to protect stored account data against disclosure and misuse are defined to include all elements specified in this requirement.