Dual Control

Applies to. Requirement 3.7.6 requires dual control, together with split knowledge, wherever personnel carry out manual cleartext key-management operations on keys that protect stored account data. Typical operations are loading a key into a device, moving key components between sites, or rebuilding a key from its parts. An entity whose keys exist only inside a hardware security module or key management system and are never handled in cleartext may have no such operations, but it must be able to show that.

Example. A payment service provider loads a new master key into an HSM. Custodian A enters the first key component and custodian B enters the second, each present for the other's entry but never seeing the other's component. If one custodian could complete the load alone because they hold both components, the control has failed, however many people are in the room.

Limits. Dual control is not separation of duties in general: it is specific to the handling of key material and means no single person can carry out the operation alone. It does not replace split knowledge; 3.7.6 requires both, one covering who must take part and the other covering who knows what. Approval of a change request by a second person is not dual control unless that person's participation is needed to complete the key operation itself.