3.7.7Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented

Defined Approach Requirements:

Key management policies and procedures are implemented to include the prevention of unauthorized substitution of cryptographic keys.

Defined Approach Testing Procedures:

3.7.7.a Examine the documented key-management policies and procedures for keys used for protection of stored account data and verify that they define prevention of unauthorized substitution of cryptographic keys.

3.7.7.b Interview personnel and/or observe processes to verify that unauthorized substitution of keys is prevented.