Key Custodian
PCIComplianceHubLast updated
A named individual formally assigned responsibility for a cryptographic key or key component. PCI DSS requires custodians to be identified, to acknowledge their responsibilities in writing, and to operate under split knowledge and dual control for clear-text key operations. Custodian records are a routine assessment request, and unsigned or missing acknowledgements are a common finding.
Applies to. Requirement 3.7.8 applies to anyone who performs key-management duties for keys protecting stored account data: they must sign, on paper or electronically, an acknowledgement of their responsibilities, and the assessor asks to see the signed records. 3.6.1 and 3.6.1.3 restrict access to keys and cleartext key components to the fewest custodians necessary, so the custodian list is also an access control the assessor examines. Where custodians handle cleartext keys manually, 3.7.6 requires them to work under split knowledge and dual control.
Example. A merchant appoints its database administrator and its security engineer as custodians for the PAN encryption key. Each signs a one-page acknowledgement listing their duties, the key components they hold and the rule that they never share them. When the security engineer moves to another role, the merchant treats the key as weakened under 3.7.5, replaces it, and appoints and signs up a new custodian.
Limits. A custodian is a role, not a job title; a system administrator who has access to key storage is a custodian whether or not anyone has called them that, and unnamed access is the usual finding. The acknowledgement under 3.7.8 is a record of accepted responsibility, not proof of competence or a background check. Custodian duties concern secret and private keys, key shares and key components; someone who handles only public keys and certificates is not a custodian in this sense.