Cryptographic Architecture
PCIComplianceHubLast updated
A documented description of how cryptography is used across an environment: the algorithms, protocols and cipher suites in use, the keys and certificates involved, where each is applied, and the plan for responding when an algorithm or protocol weakens. PCI DSS Requirement 12.3.3 requires all entities to document and review the cipher suites and protocols in use at least once every 12 months, so that a deprecation such as the retirement of TLS 1.0 or SHA-1 is acted on rather than discovered during an assessment. Requirement 3.6.1.1 places a fuller cryptographic architecture obligation on service providers. Requirement 12.3.3 was future-dated at publication and became mandatory on 31 March 2025.
Applies to. Requirement 3.6.1.1 applies to service providers only and requires a maintained document covering every algorithm, protocol and key used to protect stored account data, each key's strength, expiry date and purpose, an inventory of HSMs, key management systems and other secure cryptographic devices with type and location, and a rule keeping production and test keys apart (a bullet that was future-dated at publication). Requirement 12.3.3 applies to all entities and requires an inventory of cipher suites and protocols in use, monitoring of their continued viability, and a written plan for responding to cryptographic weaknesses, reviewed at least once every 12 months.
Example. A hosting provider that encrypts stored PAN for several merchants keeps a single architecture document: a table of keys with algorithm, length, purpose, custodian and expiry, a list of its two HSMs and its key management system with their locations, and a statement that test environments use their own keys. Its 12.3.3 review adds the TLS cipher suites on the customer-facing endpoints and records the plan for retiring any suite that industry guidance downgrades.
Limits. The document describes and inventories; it does not itself protect anything, and having it does not discharge 3.6.1 or 3.7. 3.6.1.1 is a service-provider requirement, so a merchant is not asked for it, but every entity owes the narrower cipher-suite and protocol inventory under 12.3.3. Neither requirement prescribes a format; both are tested on whether the content is present and current.
Related. Key Management, Cryptographic Key, Hardware Security Module (HSM), Key Management System, Strong Cryptography, Transport Layer Security (TLS)
Sources. PCI DSS v4.0.1 (June 2024)