3.6 Cryptographic keys protecting stored account data are secured
How to meet it
Protect keys, restrict access, and store them separately from the data.
Defined requirements
The individual PCI DSS v4.0.1 requirements under 3.6, in plain English.
3.6.1Procedures protect keys used to secure stored account data, limiting custodians and storing key-encrypting keys separately from data keys.
3.6.1.1Service providers maintain a documented cryptographic architecture covering algorithms, protocols, keys, and secure cryptographic devices.
3.6.1.2Secret and private keys are kept encrypted by a key-encrypting key, within a secure cryptographic device, or as key components/shares.
3.6.1.3Access to cleartext key components is limited to the fewest custodians needed.
3.6.1.4Cryptographic keys are stored in the fewest possible locations.
Policy templates for this control
Use these starting documents to turn the control into evidence. Adapt each template to your scope, systems, legal obligations and actual operating process.
AI use and governance policyUse for ISO 42001, AI governance, employee AI use, data handling, human review, and AI supplier risk.Access control policyUse for ISO 27001 A.5.15, A.5.16, A.5.17, A.5.18, A.8.2, SOC 2 Security, and PCI DSS requirements 7 and 8.Cryptography and key management policyUse for ISO 27001 A.8.24, secure authentication, encryption, SOC 2 Security, and PCI DSS encryption requirements.Physical and environmental security policyUse for ISO 27001 A.7.1 to A.7.14, SOC 2 Security, and PCI DSS requirement 9 physical access controls.
Open the control-to-policy mapBack to Requirement 3, or see PCI DSS templates. To run PCI controls with automation, read how AI manages controls.