Key Rotation
PCIComplianceHubLast updated
The practice of periodically changing cryptographic keys used for encryption and decryption to reduce the risk of unauthorized access to sensitive data. Key rotation is an important aspect of key management and can help organizations maintain compliance with PCI DSS by ensuring the ongoing security of encrypted cardholder data.
Applies to. PCI DSS v4.0.1 does not use the word rotation; it speaks of key changes and cryptoperiods. For keys protecting stored account data, Requirement 3's key-management controls expect each key to have a defined cryptoperiod, with NIST SP 800-57 the usual reference for setting one, a change when it ends or when compromise is suspected, and, for service providers, a cryptographic architecture document that records each key's strength and expiry date. Wireless encryption keys on networks connected to the CDE have their own triggers under Requirement 2: a change whenever someone who knew the key leaves the company or the role, and whenever compromise is suspected or known.