PCI DSS 3.7.2: Key-management policies and procedures are implemented to include secure distribution
PCI DSS v4.0.1 control 3.7.2: the requirement in full, the 2 testing procedures an assessor uses to verify it, and the related controls in section 3.7.
Requirement 3: Protect Stored Account Data › Section 3.7
Key-management policies and procedures are implemented to include secure distribution of cryptographic keys used to protect stored account data.
Summary
Write down how keys are handed over, and hand them over that way.
What the assessor will examine
These are the testing procedures the standard defines for this control. They tell you what evidence to have ready.
| Procedure | |
|---|---|
| 3.7.2.a | Examine the documented key-management policies and procedures for keys used for protection of stored account data to verify that they define secure distribution of cryptographic keys. |
| 3.7.2.b | Observe the method for distributing keys to verify that keys are distributed securely. |
Distribution is the moment a key exists outside the place that protects it, which is why it gets its own control alongside generation in 3.7.1 and storage in 3.7.3. Procedure 3.7.2.b observes the method, so this is demonstrated rather than described, and that has a practical consequence worth planning for: if you distribute keys rarely, you need something to show. Where cleartext components are handled by people, this control operates together with 3.7.6, because split knowledge is what makes a manual handover safe.
What to prepare
- The documented distribution procedure, covering each key type and each route it travels.
- A distribution to observe, or a recorded walkthrough of one if they are infrequent.
- Evidence of the protection used in transit: the wrapping key, the transport, or the split.
- Who received which key and when.
How to implement it
1. Never move a key in the clear. Wrap it under a key-encrypting key, or split it into components under 3.7.6 so that no single transfer carries a usable key.
2. Prefer distribution that is not a handover at all. A key that is generated inside the module that uses it, or fetched by an authenticated service from a managed key store, removes the distribution step and the control becomes a description of that design.
3. Keep a record of each transfer. Distribution without a record leaves you unable to answer who holds what, which is also what 3.7.5 needs when someone leaves.
4. Rehearse it. The observation in 3.7.2.b goes badly when the procedure has not been performed since it was written.
Where this commonly fails
- Keys sent by email or chat, sometimes split across two messages in the same mailbox, which is not split knowledge.
- A documented procedure that has never been exercised, so the observation is a first attempt.
- Keys distributed to a team address rather than to named custodians.
- Cloud key material pasted into a console or a pipeline variable by hand.
Related controls
Others in section 3.7:
| Control | What it requires |
|---|---|
| 3.7.1 | Key-management policies and procedures are implemented to include generation of strong… |
| 3.7.3 | Key-management policies and procedures are implemented to include secure storage… |
| 3.7.4 | Key management policies and procedures are implemented for cryptographic key changes for keys… |
| 3.7.5 | Key management policies procedures are implemented to include the retirement, replacement… |
| 3.7.6 | Where manual cleartext cryptographic key-management operations are performed by personnel… |
| 3.7.7 | Key management policies and procedures are implemented to include the prevention… |
| 3.7.8 | Key management policies and procedures are implemented to include that cryptographic key… |
| 3.7.9 | Service providers: Where a service provider shares cryptographic keys with its customers for transmission… |
← 3.7.1 · All controls · 3.7.3 →
Source
The requirement text and testing procedures above are reproduced from PCI DSS v4.0.1 (June 2024), ©2006-2024 PCI Security Standards Council, LLC. All rights reserved. The commentary is our own.
The official standard is authoritative and also contains the Customized Approach Objective, applicability notes and guidance for this control. Download it from the PCI Security Standards Council document library. PCI DSS is a registered standard of the PCI Security Standards Council, LLC, which does not endorse this site. Nothing here is a substitute for advice from a Qualified Security Assessor.