3.5.3 Are secret and private cryptographic keys used to Review documented encrypt/decrypt cardholder data stored in one (or more) procedures of the following forms at all times? Examine system configurations Encrypted with a key-encrypting key that is at least and key storage locations, as strong as the data-encrypting key, and that is including for key-encrypting stored separately from the data-encrypting key keys Within a secure cryptographic device (such as a hardware (host) security module (HSM) or approved point-of-interaction device) As at least two full-length key components or key shares, in accordance with an industry-accepted method. Note: It is not required that public keys be stored in one of these forms. 3.5.4 Are cryptographic keys stored in the fewest possible Examine key-storage locations locations? Observe processes Are all key-management processes and procedures 3.6 Review key-management fully documented and implemented for procedures cryptographic keys used for encryption of cardholder data? This testing procedure applies only to service providers. Are key-management processes and procedures implemented to require the following: 3.6.1 Do cryptographic key procedures include the generation Review key-management of strong cryptographic keys? procedures Observe key-generation method
3.5.3 Are secret and private cryptographic keys used to encrypt/decrypt cardholder data stored in one (or more) of the following forms at all times? Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the data-encrypting key Within a secure cryptographic device (such as a hardware (host) security module (HSM) or point-of-interaction device) As at least two full-length key components or key shares, in accordance with an industry-accepted method. Note: It is not required that public keys be stored in one of these forms. Review documented procedures Examine system configurations and key storage locations, including for key-encrypting keys 3.5.4 Are cryptographic keys stored in the fewest possible locations? Examine key-storage locations Observe processes 3.6 Are all key-management processes and procedures fully documented and implemented for cryptographic keys used for encryption of cardholder data? Review key-management procedures This testing procedure applies only to service providers. Are key-management processes and procedures implemented to require the following: 3.6.1 Do cryptographic key procedures include the generation of strong cryptographic keys? Review key-management procedures Observe key-generation method approved
PCI-DSS-v3_2-SAQ-D_Merchant-rev1_1.docx