Encryption Key

Applies to. In the requirement text the phrase appears for wireless networks connected to the CDE or transmitting account data: 2.3.1 requires default wireless encryption keys to be changed at installation or confirmed secure, and 2.3.2 requires them to be changed whenever someone with knowledge of the key leaves the company or the role that needed it, and whenever a key is suspected or known to be compromised. Keys that protect stored account data are governed by Requirement 3's key-management controls, which restrict access to the fewest custodians necessary, keep keys in the fewest locations and forms, and require any key-encrypting key to be at least as strong as, and stored separately from, the data-encrypting key it protects.

Limits. 2.3.2 sets no rotation interval; it names the two events that force a key change, and assessors verify it by interview and by examining key-management documentation.