3.7.6 Split knowledge and dual control for manual key operations

Where staff perform manual key-management operations involving cleartext keys, key-management policies and procedures must be in place under which those operations are run with dual control and split knowledge. Applicability: applies to manual key-management operations; simply dividing a key into two parts does not comply, and any key component or share has to be generated either by an approved random number generator inside an SCD (an HSM or a point-of-interaction device with PTS approval, for example) OR in line with ISO 19592 or an equivalent standard for secret key share generation. Guidance defines split knowledge (each person holds only their own component, revealing nothing of others or the key) and dual control (two or more people needed to use a key or perform a key function), and warns that in m-of-n schemes a custodian must never know more than one component, now or previously. Examples of manual operations include generation, transmission, loading, storage and destruction. Objective under the customized approach: no one can know a cleartext secret or private key, and no single person can carry out operations involving cleartext keys.

Source: PCI DSS v4.0.1, 3.7.6. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open PCI DSS v4.0.1 in the compliance library.

Version 4.0.1 is the active version; 4.0 has been retired. Appendix A1 applies only to multi-tenant service providers, A2 only to card-present POS POI terminals that still use SSL or early TLS, and A3 only when a payment brand or acquirer requires it. Which requirements apply to you follows your validation type.