PKI (Public Key Infrastructure)

PCIComplianceHubLast updated

A system that manages the creation, distribution, and revocation of public key certificates for use in public key cryptography. PKI can be used to secure communications and authenticate users within the cardholder data environment, supporting PCI DSS compliance.

Applies to. PCI DSS v4.0.1 does not name PKI. It reaches the concept through the certificates a PKI issues: Requirement 4 asks that only trusted keys and certificates be accepted when PAN crosses open, public networks, that those certificates be confirmed valid and neither expired nor revoked, and that keys or certificates that cannot be verified as trusted be rejected, which presumes a certificate authority and a working revocation check behind them.
Limits. Requirement 4 asks that the certificates in use be trusted, valid and unrevoked; it does not ask the entity to operate its own PKI or certificate authority.
Related. Certificate Authority (CA), Digital Certificate, X.509, Asymmetric Encryption
Sources. PCI DSS v4.0.1 (June 2024)