3.6.3 Do cryptographic key procedures include secure Review key-management cryptographic key storage? procedures Observe the method for secure storage of keys 3.6.4 Do cryptographic key procedures include cryptographic Review key-management key changes for keys that have reached the end of procedures defined cryptoperiod (for example, after a defined period Interview personnel of time has passed and/or after a certain amount of cipher-text has been produced by a given key), as defined by the associated application vendor or key owner, and based on industry best practices and guidelines (for example, NIST Special Publication 800-57)? Do cryptographic key procedures include retirement 3.6.5 Review key-management or replacement (for example, archiving, destruction, procedures and/or revocation) of cryptographic keys when the Interview personnel integrity of the key has been weakened (for example, departure of an employee with knowledge of a key)? Do cryptographic key procedures include replacement Review key-management of known or suspected compromised keys? procedures Interview personnel If retired or replaced cryptographic keys are retained, Review key-management are these keys only used for decryption/verification procedures purposes, and not used for encryption operations? Interview personnel
3.6.3 Do cryptographic key procedures include secure cryptographic key storage? Review key-management procedures Observe the method for secure storage of keys 3.6.4 Do cryptographic key procedures include cryptographic key changes for keys that have reached the end of defined cryptoperiod (for example, after a defined period of time has passed and/or after a certain amount of cipher-text has been produced by a given key), as defined by the associated application vendor or key owner, and based on industry best practices and guidelines (for example, NIST Special Publication 800-57)? Review key-management procedures Interview personnel 3.6.5 Do cryptographic key procedures include retirement or replacement (for example, archiving, destruction, and/or revocation) of cryptographic keys when the integrity of the key has been weakened (for example, departure of an employee with knowledge of a key)? Review key-management procedures Interview personnel Do cryptographic key procedures include replacement of known or suspected compromised keys? Review key-management procedures Interview personnel If retired or replaced cryptographic keys are retained, are these keys only used for decryption/verification purposes, and not used for encryption operations? Review key-management procedures Interview personnel
PCI_DSS_v3-1_SAQ_D_Merchant_rev1-1.docx