3.7.3Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented

Defined Approach Requirements:

Key-management policies and procedures are implemented to include secure storage of cryptographic keys used to protect stored account data.

Defined Approach Testing Procedures:

3.7.3.a Examine the documented key-management policies and procedures for keys used for protection of stored account data to verify that they define secure storage of cryptographic keys.

3.7.3.b Observe the method for storing keys to verify that keys are stored securely.