What it means
PCI cryptographic key control evidence demonstrates that key generation, distribution, storage, access, rotation, replacement, revocation, destruction, and split knowledge or dual control operate as designed.
Why it matters
Strong algorithms do not protect payment data when keys are exposed, shared, retained too long, recoverable by one person, or managed outside monitored procedures.
Practical focus
- Inventory keys, purpose, algorithm, owner, custodian, location, dependencies, lifecycle state, and protected data.
- Collect system records and observed ceremony evidence for generation, access, rotation, backup, recovery, compromise response, and destruction.
- Test separation of duties, least privilege, key-encryption keys, hardware protections, and emergency access.
- Preserve this evidence: Retain approved definitions, decisions, operating records, exceptions, test results, and change history that show how PCI Cryptographic Key Control Evidence works over time.
- Exercise this failure scenario: One administrator can export both encrypted payment data and the keys needed to decrypt it without independent approval or alerting.
Common mistakes
- Using PCI Cryptographic Key Control Evidence as a label without defining its scope, owner, decision criteria, and expected evidence.
- Treating a diagram, policy, tool screen, or meeting as proof that PCI Cryptographic Key Control Evidence operates consistently in real work.
- Optimizing for a one-time review while leaving normal operating decisions, exceptions, and handoffs uncontrolled.
- Testing only the expected path and never rehearsing this failure condition: One administrator can export both encrypted payment data and the keys needed to decrypt it without independent approval or alerting.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: