Data Encrypting Key (DEK)

Applies to. 3.6.1 requires documented and implemented procedures that protect DEKs used for stored account data against disclosure and misuse: access limited to the fewest custodians necessary, storage in the fewest possible locations and forms, and any key-encrypting key at least as strong as the DEK and stored apart from it. 3.6.1.2 requires that such a key exist at all times in one or more of three forms, encrypted under a KEK, inside a secure cryptographic device such as an HSM or PTS-approved point-of-interaction device, or as at least two full-length key components or key shares, and assessors check system configurations and key storage locations to confirm it.

Limits. Both controls apply to keys that protect stored account data. Wireless encryption keys have their own change triggers under Requirement 2, and the standard's transmission controls speak of trusted keys and certificates rather than of DEKs.