3.6.6 If manual clear-text key-management operations are Review key-management used, do cryptographic key procedures include split procedures knowledge and dual control of cryptographic keys as Interview personnel and/or follows: Observe processes Do split knowledge procedures require that key components are under the control of at least two people who only have knowledge of their own key components? AND Do dual control procedures require that at least two people are required to perform any key management operations and no one person has access to the authentication materials (for example, passwords or keys) of another? Note: Examples of manual key management operations include, but are not limited to: key generation, transmission, loading, storage and destruction. 3.6.7 Do cryptographic key procedures include the prevention Review procedures of unauthorized substitution of cryptographic keys? Interview personnel and/or Observe processes 3.6.8 Are cryptographic key custodians required to formally Review procedures acknowledge (in writing or electronically) that they Review documentation or other understand and accept key-custodian evidence responsibilities? 3.7 Are security policies and operational procedures for Review security policies and operational procedures protecting stored cardholder data: Interview personnel Documented In use Known to all affected parties?
3.6.6 If manual clear-text key-management operations are used, do cryptographic key procedures include split knowledge and dual control of cryptographic keys as follows: Do split knowledge procedures require that key components are under the control of at least two people who only have knowledge of their own key components? AND Do dual control procedures require that at least two people are required to perform any key management operations and no one person has access to the authentication materials (for example, passwords or keys) of another? Note: Examples of manual key management operations include, but are not limited to: key generation, transmission, loading, storage and destruction. Review key-management procedures Interview personnel and/or Observe processes 3.6.7 Do cryptographic key procedures include the prevention of unauthorized substitution of cryptographic keys? Review procedures Interview personnel and/or Observe processes 3.6.8 Are cryptographic key custodians required to formally acknowledge (in writing or electronically) that they understand and accept key-custodian responsibilities? Review procedures Review documentation or other evidence 3.7 Are security policies and operational procedures for protecting stored cardholder data: Documented In use Known to all affected parties? Review security policies and operational procedures Interview personnel
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx