Protect Stored Cardholder Data

Requirement 3: Protect stored cardholder data

Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.1 Keep cardholder data storage to a minimum by implementing data-retention and disposal policies, procedures and processes
that include at least the following for all CHD storage:
 Limiting data storage amount and retention time to that which is required for legal, regulatory, and/or business requirements.
☐ ☐ ☐ ☐ ☐
 Specific retention requirements for cardholder data
 Processes for secure deletion of data when no longer needed.
 A quarterly process for identifying and securely deleting stored cardholder data that exceeds defined retention.
3.1.a Examine the data-retention and Identify the data-retention and disposal Not Mentioned
disposal policies, procedures and documentation examined to verify policies,
processes to verify they include the procedures, and processes define the following for
following for all cardholder data (CHD) all cardholder data (CHD) storage:
storage:  Limiting data storage amount and retention time
 Limiting data storage amount and to that which is required for legal, regulatory,
retention time to that which is required and/or business requirements for data retention.
for legal, regulatory, and/or business  Specific requirements for retention of cardholder
requirements. data.
 Specific requirements for retention of  Processes for secure deletion of cardholder
cardholder data (for example, data when no longer needed for legal,
cardholder data needs to be held for X regulatory, or business reasons.
period for Y business reasons).  A quarterly process for identifying and securely
 Processes for secure deletion of deleting stored cardholder data that exceeds
cardholder data when no longer defined retention requirements.
needed for legal, regulatory, or
business reasons
 A quarterly process for identifying and
securely deleting stored cardholder
data that exceeds defined retention
requirements.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 1
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.1.b Interview personnel to verify that: Identify the responsible personnel interviewed
who confirm that:
 All locations of stored cardholder data
are included in the data-retention and  All locations of stored cardholder data are
disposal processes. included in the data-retention and disposal
processes.
 Either a quarterly automatic or manual
process is in place to identify and  Either a quarterly automatic or manual process
securely delete stored cardholder is in place to identify and securely delete stored
data. cardholder data.
 The quarterly automatic or manual  The quarterly automatic or manual process is
process is performed for all locations performed for all locations of cardholder data.
of cardholder data.
3.1.c For a sample of system components Identify the sample of system components selected
that store cardholder data: for this testing procedure.
 Examine files and system records to For each item in the sample, describe how files and
verify that the data stored does not system records verified that the data stored does not
exceed the requirements defined in exceed the requirements defined in the data-retention
the data-retention policy. policy.
 Observe the deletion mechanism to Describe how the deletion mechanism was observed Not Mentioned
verify data is deleted securely. to verify data is deleted securely.
3.2 Do not store sensitive authentication data after authorization (even if encrypted). If sensitive authentication data is received,
render all data unrecoverable upon completion of the authorization process.
It is permissible for issuers and companies that support issuing services to store sensitive authentication data if:
 There is a business justification, and ☐ ☐ ☐ ☐ ☐
 The data is stored securely.
Sensitive authentication data includes the data as cited in the following Requirements 3.2.1 through 3.2.3:
3.2.a For issuers and/or companies that Indicate whether the assessed entity is an issuer or
support issuing services and store supports issuing service. (yes/no)
sensitive authentication data, review
policies and interview personnel to verify If “yes,” complete the responses for 3.2.a and 3.2.b and mark 3.2.c and 3.2.d as “Not Applicable.”
there is a documented business If “no,” mark the remainder of 3.2.a and 3.2.b as “Not Applicable” and proceed to 3.2.c and 3.2.d.
justification for the storage of sensitive
authentication data. Identify the documentation reviewed to verify there Not Mentioned
is a documented business justification for the storage
of sensitive authentication data.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 2
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
Identify the interviewed personnel who confirm
there is a documented business justification for the
storage of sensitive authentication data.
For the interview, summarize the relevant details of
the business justification described.
3.2.b For issuers and/or companies that If “yes” at 3.2.a,
support issuing services and store
sensitive authentication data, examine Identify data stores examined.
data stores and system configurations to
Describe how the data stores and system
verify that the sensitive authentication data
configurations were examined to verify that the
is secured.
sensitive authentication data is secured.
3.2.c For all other entities, if sensitive Indicate whether sensitive authentication data is
authentication data is received, review received. (yes/no)
policies and procedures, and examine
system configurations to verify the data is If “yes,” complete 3.2.c and 3.2.d.
not retained after authorization. If “no,” mark the remainder of 3.2.c and 3.2.d as “Not Applicable” and proceed to 3.2.1.
Identify the document(s) reviewed to verify the data Not Mentioned
is not retained after authorization.
Describe how system configurations verified that the
data is not retained after authorization.
3.2.d For all other entities, if sensitive Identify the document(s) reviewed to verify that it Not Mentioned
authentication data is received, review defines processes for securely deleting the data so
procedures and examine the processes for that it is unrecoverable.
securely deleting the data to verify that the
Describe how the processes for securely deleting
data is unrecoverable.
the data were examined to verify that the data is
unrecoverable.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 3
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.2.1 Do not store the full contents of any track (from the magnetic stripe located on the back of a card, equivalent data contained
on a chip, or elsewhere) after authorization. This data is alternatively called full track, track, track 1, track 2, and magnetic-stripe
data.
Note: In the normal course of business, the following data elements from the magnetic stripe may need to be retained:
 The cardholder’s name
☐ ☐ ☐ ☐
 Primary account number (PAN)
 Expiration date
 Service code
To minimize risk, store only these data elements as needed for business.
3.2.1 For a sample of system components, Identify the sample of system components selected
examine data sources, including but not for 3.2.1-3.2.3.
limited to the following, and verify that the
full contents of any track from the magnetic For each data source type below from the sample of system of components examined, summarize the specific examples of each
stripe on the back of card or equivalent data source type observed to verify that the full contents of any track from the magnetic stripe on the back of card or equivalent
data on a chip are not stored after data on a chip are not stored after authorization. If that type of data source is not present, indicate that in the space.
authorization:
 Incoming transaction data
 Incoming transaction data
 All logs (for example, transaction, history,  All logs (for example, transaction, history,
debugging, error) debugging error)
 History files  History files
 Trace files
 Several database schemas  Trace files
 Database contents  Database schemas

 Database contents

 If applicable, any other output observed to be

generated
3.2.2 Do not store the card verification code or value (three-digit or four-digit number printed on the front or back of a payment
card) used to verify card-not-present transactions after authorization. ☐ ☐ ☐ ☐

3.2.2 For a sample of system components, For each data source type below from the sample of system of components at 3.2.1, summarize the specific examples of each
examine data sources, including but not data source type observed to verify that the three-digit or four-digit card verification code or value printed on the front of the card
limited to the following, and verify that the
or the signature panel (CVV2, CVC2, CID, CAV2 data) is not stored after authorization. If that type of data source is not present,
three-digit or four-digit card verification
indicate that in the space.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 4
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
code or value printed on the front of the  Incoming transaction data
card or the signature panel (CVV2, CVC2,
CID, CAV2 data) is not stored after  All logs (for example, transaction, history,
authorization: debugging error)
 Incoming transaction data  History files
 All logs (for example, transaction, history,
debugging, error)  Trace files
 History files  Database schemas
 Trace files
 Several database schemas  Database contents
 Database contents  If applicable, any other output observed to be
generated
3.2.3 Do not store the personal identification number (PIN) or the encrypted PIN block after authorization. ☐ ☐ ☐ ☐
3.2.3 For a sample of system components, For each data source type below from the sample of system of components at 3.2.1, summarize the specific examples of each
examine data sources, including but not data source type observed to verify that PINs and encrypted PIN blocks are not stored after authorization. If that type of data
limited to the following and verify that PINs source is not present, indicate that in the space.
and encrypted PIN blocks are not stored
after authorization:  Incoming transaction data
 Incoming transaction data  All logs (for example, transaction, history,
 All logs (for example, transaction, history, debugging error)
debugging, error)
 History files  History files
 Trace files  Trace files
 Several database schemas
 Database contents  Database schemas

 Database contents

 If applicable, any other output observed to be

generated

3.3 Mask PAN when displayed (the first six and last four digits are the maximum number of digits to be displayed), such that only
personnel with a legitimate business need can see more than first six/last four digits of the PAN.
☐ ☐ ☐ ☐ ☐
Note: This requirement does not supersede stricter requirements in place for displays of cardholder data—for example, legal or
payment card brand requirements for point-of-sale (POS) receipts.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 5
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.3.a Examine written policies and Identify the document(s) reviewed to verify that Not Mentioned
procedures for masking the display of written policies and procedures for masking the
PANs to verify: displays of PANs include the following:
 A list of roles that need access to  A list of roles that need access to displays of
displays of more than first six/last four more than first six/last four (includes full PAN) is
(includes full PAN) is documented, documented, together with a legitimate business
together with a legitimate business need for each role to have such access.
need for each role to have such  PAN must be masked when displayed such that
access. only personnel with a legitimate business need
 PAN must be masked when displayed can see more than first six/last four digits of the
such that only personnel with a PAN.
legitimate business need can see  All roles not specifically authorized to see the full
more than the first six/last four digits of PAN must only see masked PANs.
the PAN.
 All roles not specifically authorized to
see the full PAN must only see
masked PANs.
3.3.b Examine system configurations to Describe how system configurations verified that:
verify that full PAN is only displayed for
users/roles with a documented business  Full PAN is only displayed for users/roles with a
need, and that PAN is masked for all other documented business need.
requests.  PAN is masked for all other requests.

3.3.c Examine displays of PAN (for Describe how displays of PAN verified that:
example, on screen, on paper receipts) to
verify that PANs are masked when  PANs are masked when displaying cardholder
displaying cardholder data, and that only data.
those with a legitimate business need are  Only those with a legitimate business need are
able to see more than first six/last four able to see more than first six/last four digits of
digits of the PAN. the PAN.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 6
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.4 Render PAN unreadable anywhere it is stored (including on portable digital media, backup media, and in logs) by using any of
the following approaches:
 One-way hashes based on strong cryptography, (hash must be of the entire PAN).
 Truncation (hashing cannot be used to replace the truncated segment of PAN).
 Index tokens and pads (pads must be securely stored).
☐ ☐ ☐ ☐ ☐
 Strong cryptography with associated key-management processes and procedures.
Note: It is a relatively trivial effort for a malicious individual to reconstruct original PAN data if they have access to both the
truncated and hashed version of a PAN. Where hashed and truncated versions of the same PAN are present in an entity’s
environment, additional controls must be in place to ensure that the hashed and truncated versions cannot be correlated to
reconstruct the original PAN.
3.4.a Examine documentation about the Identify the documentation examined to verify that Not Mentioned
system used to protect the PAN, including the PAN is rendered unreadable using any of the
the vendor, type of system/process, and following methods:
the encryption algorithms (if applicable) to
 One-way hashes based on strong cryptography,
verify that the PAN is rendered unreadable
using any of the following methods:  Truncation
 Index tokens and pads, with the pads being
 One-way hashes based on strong
securely stored
cryptography,
 Strong cryptography, with associated key-
 Truncation
management processes and procedures
 Index tokens and pads, with the pads
being securely stored
 Strong cryptography, with associated
key-management processes and
procedures
3.4.b Examine several tables or files from Identify the sample of data repositories selected for
a sample of data repositories to verify the this testing procedure.
PAN is rendered unreadable (that is, not
Identify the tables or files examined for each item in
stored in plain-text).
the sample of data repositories.
For each item in the sample, describe how the
tables or files verified that the PAN is rendered
unreadable.
3.4.c Examine a sample of removable Identify the sample of removable media selected for
media (for example, backup tapes) to this testing procedure.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 7
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
confirm that the PAN is rendered For each item in the sample, describe how the
unreadable. sample of removable media confirmed that the PAN
is rendered unreadable.
3.4.d Examine a sample of audit logs, Identify the sample of audit logs, including payment
including payment application logs, to application logs, selected for this testing procedure.
confirm that PAN is rendered unreadable
For each item in the sample, describe how the
or is not present in the logs.
sample of audit logs, including payment application
logs, confirmed that the PAN is rendered unreadable
or is not present in the logs.
3.4.e If hashed and truncated versions of Identify whether hashed and truncated versions of
the same PAN are present in the the same PAN are present in the environment
environment, examine implemented (yes/no)
controls to verify that the hashed and If ‘no,’ mark 3.4.e as ‘not applicable’ and proceed to
truncated versions cannot be correlated to
3.4.1.
reconstruct the original PAN.
If ‘yes,’ describe the implemented controls examined
to verify that the hashed and truncated versions
cannot be correlated to reconstruct the original PAN.
3.4.1 If disk encryption is used (rather than file- or column-level database encryption), logical access must be managed separately
and independently of native operating system authentication and access control mechanisms (for example, by not using local user
account databases or general network login credentials). Decryption keys must not be associated with user accounts.
☐ ☐ ☐ ☐ ☐

Note: This requirement applies in addition to all other PCI DSS encryption and key management requirements.
3.4.1.a If disk encryption is used, inspect Indicate whether disk encryption is used. (yes/no)
the configuration and observe the
authentication process to verify that logical If “yes,” complete the remainder of 3.4.1.a, 3.4.1.b, and 3.4.1.c.
access to encrypted file systems is
If “no,” mark the remainder of 3.4.1.a, 3.4.1.b and 3.4.1.c as “Not Applicable.’
implemented via a mechanism that is
separate from the native operating Describe the disk encryption mechanism(s) in use.
system’s authentication mechanism (for
example, not using local user account For each disk encryption mechanism in use,
databases or general network login describe how the configuration verified that logical
credentials). access to encrypted file systems is separate from the
native operating system’s authentication mechanism.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 8
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
For each disk encryption mechanism in use,
describe how the authentication process was
observed to verify that logical access to encrypted file
systems is separate from the native operating
system’s authentication mechanism.
3.4.1.b Observe processes and interview Describe how processes were observed to verify
personnel to verify that cryptographic keys that cryptographic keys are stored securely.
are stored securely (for example, stored on
Identify the responsible personnel interviewed who
removable media that is adequately
confirm that cryptographic keys are stored securely.
protected with strong access controls).
3.4.1.c Examine the configurations and Describe how the configurations verified that
observe the processes to verify that cardholder data on removable media is encrypted
cardholder data on removable media is wherever stored.
encrypted wherever stored.
Describe how processes were observed to verify
Note: If disk encryption is not used to that cardholder data on removable media is
encrypt removable media, the data stored encrypted wherever stored.
on this media will need to be rendered
unreadable through some other method.
3.5 Document and implement procedures to protect keys used to secure stored cardholder data against disclosure and misuse:
Note: This requirement applies to keys used to encrypt stored cardholder data, and also applies to key-encrypting keys used to ☐ ☐ ☐ ☐ ☐
protect data-encrypting keys—such key-encrypting keys must be at least as strong as the data-encrypting key.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 9
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.5 Examine key-management policies and Identify the documented key-management Not Mentioned
procedures to verify processes are policies and processes examined to verify
specified to protect keys used for processes are defined to protect keys used for
encryption of cardholder data against encryption of cardholder data against disclosure and
disclosure and misuse and include at least misuse and include at least the following:
the following:  Access to keys is restricted to the fewest number
 Access to keys is restricted to the of custodians necessary.
fewest number of custodians  Key-encrypting keys are at least as strong as the
necessary. data-encrypting keys they protect.
 Key-encrypting keys are at least as  Key-encrypting keys are stored separately from
strong as the data-encrypting keys data-encrypting keys.
they protect.  Keys are stored securely in the fewest possible
 Key-encrypting keys are stored locations and forms.
separately from data-encrypting keys.
 Keys are stored securely in the fewest
possible locations and forms.
3.5.1 Additional requirement for service providers only: Maintain a documented description of the cryptographic architecture
that includes:
 Details of all algorithms, protocols, and keys used for the protection of cardholder data, including key strength and expiry date ☐ ☐ ☐ ☐ ☐
 Description of the key usage for each key.
 Inventory of any HSMs and other SCDs used for key management

3.5.1 Interview responsible personnel and Identify the responsible personnel interviewed
review documentation to verify that a who confirm that a document exists to describe the
document exists to describe the cryptographic architecture, including:
cryptographic architecture, including:  Details of all algorithms, protocols, and keys
 Details of all algorithms, protocols, used for the protection of cardholder data,
and keys used for the protection of including key strength and expiry date
cardholder data, including key  Description of the key usage for each key
strength and expiry date
 Inventory of any HSMs and other SCDs used for
key management

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 10
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place

 Description of the key usage for each Identify the documentation reviewed to verify that Not Mentioned
key it contains a description of the cryptographic
 Inventory of any HSMs and other architecture, including:
SCDs used for key management  Details of all algorithms, protocols, and keys
used for the protection of cardholder data,
including key strength and expiry date
 Description of the key usage for each key
 Inventory of any HSMs and other SCDs used for
key management
3.5.2 Restrict access to cryptographic keys to the fewest number of custodians necessary. ☐ ☐ ☐ ☐ ☐
3.5.2 Examine user access lists to verify Identify user access lists examined.
that access to keys is restricted to the
fewest number of custodians necessary. Describe how the user access lists verified that
access to keys is restricted to the fewest number of
custodians necessary.
3.5.3 Store secret and private keys used to encrypt/decrypt cardholder data in one (or more) of the following forms at all times:
 Encrypted with a key-encrypting key that is at least as strong as the data-encrypting key, and that is stored separately from the
data-encrypting key.
 Within a secure cryptographic device (such as a hardware/host security module (HSM) or PTS-approved point-of-interaction ☐ ☐ ☐ ☐ ☐
device).
 As at least two full-length key components or key shares, in accordance with an industry-accepted method.
Note: It is not required that public keys be stored in one of these forms.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 11
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.5.3.a Examine documented procedures Identify the documented procedures examined to Not Mentioned
to verify that cryptographic keys used to verify that cryptographic keys used to encrypt/decrypt
encrypt/decrypt cardholder data must only cardholder data must only exist in one (or more) of
exist in one (or more) of the following the following forms at all times.
forms at all times.  Encrypted with a key-encrypting key that is at
 Encrypted with a key-encrypting key that least as strong as the data-encrypting key, and
is at least as strong as the data- that is stored separately from the data-encrypting
encrypting key, and that is stored key.
separately from the data-encrypting key.  Within a secure cryptographic device (such as a
 Within a secure cryptographic device hardware (host) security module (HSM) or PTS-
(such as a hardware (host) security approved point-of-interaction device).
module (HSM) or PTS-approved point-of-  As key components or key shares, in accordance
interaction device). with an industry-accepted method.
 As key components or key shares, in
accordance with an industry-accepted
method.
3.5.3.b Examine system configurations Provide the name of the assessor who attests that
and key storage locations to verify that all locations where keys are stored were identified.
cryptographic keys used to encrypt/decrypt
Describe how system configurations and key
cardholder data exist in one, (or more), of
storage locations verified that cryptographic keys
the following form at all times.
used to encrypt/decrypt cardholder data must only
 Encrypted with a key-encrypting key. exist in one (or more) of the following forms at all
 Within a secure cryptographic device times.
(such as a hardware (host) security  Encrypted with a key-encrypting key that is at
module (HSM) or PTS-approved point-of- least as strong as the data-encrypting key, and
interaction device). that is stored separately from the data-encrypting
 As key components or key shares, in key.
accordance with an industry-accepted
 Within a secure cryptographic device (such as a
method.
hardware (host) security module (HSM) or PTS-
approved point-of-interaction device).
 As key components or key shares, in accordance
with an industry-accepted method.
3.5.3.c Wherever key-encrypting keys are Describe how system configurations and key storage locations verified that, wherever key-encrypting keys are used:
used, examine system configurations and
key storage locations to verify:  Key-encrypting keys are at least as strong as the
data-encrypting keys they protect.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 12
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
 Key-encrypting keys are at least as  Key-encrypting keys are stored separately from
strong as the data-encrypting keys they data-encrypting keys.
protect.
 Key-encrypting keys are stored
separately from data-encrypting keys.
3.5.4 Store cryptographic keys in the fewest possible locations. ☐ ☐ ☐ ☐ ☐
3.5.4 Examine key storage locations and Describe how key storage locations and the
observe processes to verify that keys are observed processes verified that keys are stored in
stored in the fewest possible locations. the fewest possible locations.
3.6 Fully document and implement all key-management processes and procedures for cryptographic keys used for encryption of
cardholder data, including the following:
☐ ☐ ☐ ☐ ☐
Note: Numerous industry standards for key management are available from various resources including NIST, which can be found
at http://csrc.nist.gov.
3.6.a Additional Procedure for service Indicate whether the assessed entity is a service
provider assessments only: If the service provider that shares keys with their customers for
provider shares keys with their customers transmission or storage of cardholder data. (yes/no)
for transmission or storage of cardholder
If “yes,” Identify the document that the service
data, examine the documentation that the
provider provides to their customers examined to
service provider provides to their
verify that it includes guidance on how to securely
customers to verify that it includes
transmit, store and update customers’ keys, in
guidance on how to securely transmit,
accordance with Requirements 3.6.1 through 3.6.8
store, and update customers’ keys, in
below.
accordance with Requirements 3.6.1
through 3.6.8 below.

3.6.b Examine the key-management procedures and processes for keys used for encryption of cardholder data and perform the following:
3.6.1 Generation of strong cryptographic keys. ☐ ☐ ☐ ☐ ☐
3.6.1.a Verify that key-management Identify the documented key-management Not Mentioned
procedures specify how to generate strong procedures examined to verify procedures specify
keys. how to generate strong keys.
3.6.1.b Observe the procedures for Describe how the procedures for generating keys
generating keys to verify that strong keys were observed to verify that strong keys are
are generated. generated.
3.6.2 Secure cryptographic key distribution. ☐ ☐ ☐ ☐ ☐

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 13
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.6.2.a Verify that key-management Identify the documented key-management Not Mentioned
procedures specify how to securely procedures examined to verify procedures specify
distribute keys. how to securely distribute keys.
3.6.2.b Observe the method for distributing Describe how the method for distributing keys was
keys to verify that keys are distributed observed to verify that keys are distributed securely.
securely.
3.6.3 Secure cryptographic key storage. ☐ ☐ ☐ ☐ ☐
3.6.3.a Verify that key-management Identify the documented key-management Not Mentioned
procedures specify how to securely store procedures examined to verify procedures specify
keys. how to securely store keys.
3.6.3.b Observe the method for storing Describe how the method for storing keys was
keys to verify that keys are stored observed to verify that keys are stored securely.
securely.
3.6.4 Cryptographic key changes for keys that have reached the end of their cryptoperiod (for example, after a defined period of
time has passed and/or after a certain amount of cipher-text has been produced by a given key), as defined by the associated
application vendor or key owner, and based on industry best practices and guidelines (for example, NIST Special Publication 800- ☐ ☐ ☐ ☐ ☐
57).
3.6.4.a Verify that key-management Identify the documented key-management Not Mentioned
procedures include a defined cryptoperiod procedures examined to verify procedures include a
for each key type in use and define a defined cryptoperiod for each key type in use and
process for key changes at the end of the define a process for key changes at the end of the
defined cryptoperiod(s). defined cryptoperiod(s).
3.6.4.b Interview personnel to verify that Identify the responsible personnel interviewed who
keys are changed at the end of the defined confirm that keys are changed at the end of the
cryptoperiod(s). defined cryptoperiod(s).
3.6.5 Retirement or replacement (for example, archiving, destruction, and/or revocation) of keys as deemed necessary when the
integrity of the key has been weakened (for example, departure of an employee with knowledge of a clear-text key component), or
keys are suspected of being compromised. ☐ ☐ ☐ ☐ ☐
Note: If retired or replaced cryptographic keys need to be retained, these keys must be securely archived (for example, by using a
key-encryption key). Archived cryptographic keys should only be used for decryption/verification purposes.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 14
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.6.5.a Verify that key-management Identify the documented key-management Not Mentioned
procedures specify processes for the procedures examined to verify that key-management
following: processes specify the following:
 The retirement or replacement of keys  The retirement or replacement of keys when the
when the integrity of the key has been integrity of the key has been weakened.
weakened.  The replacement of known or suspected
 The replacement of known or suspected compromised keys.
compromised keys.  Any keys retained after retiring or replacing are
 Any keys retained after retiring or not used for encryption operations.
replacing are not used for encryption
operations.
3.6.5.b Interview personnel to verify the Identify the responsible personnel interviewed who
following processes are implemented: confirm that the following processes are
 Keys are retired or replaced as implemented:
necessary when the integrity of the key  Keys are retired or replaced as necessary when the
has been weakened, including when integrity of the key has been weakened, including
someone with knowledge of the key when someone with knowledge of the key leaves
leaves the company. the company.
 Keys are replaced if known or suspected  Keys are replaced if known or suspected to be
to be compromised. compromised.
 Any keys retained after retiring or  Any keys retained after retiring or replacing are not
replacing are not used for encryption used for encryption operations.
operations.
3.6.6 If manual clear-text cryptographic key-management operations are used, these operations must be managed using split
knowledge and dual control.
☐ ☐ ☐ ☐ ☐
Note: Examples of manual key-management operations include, but are not limited to: key generation, transmission, loading,
storage and destruction.
3.6.6.a Verify that manual clear-text key- Indicate whether manual clear-text cryptographic
management procedures specify key-management operations are used. (yes/no)
processes for the use of the following:
If “no,” mark the remainder of 3.6.6.a and 3.6.6.b as “Not Applicable.”
 Split knowledge of keys, such that key
components are under the control of at If “yes,” complete 3.6.6.a and 3.6.6.b.

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 15
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
least two people who only have Identify the documented key-management Not Mentioned
knowledge of their own key components; procedures examined to verify that manual clear-text
AND key-management procedures define processes for
 Dual control of keys, such that at least the use of the following:
two people are required to perform any  Split knowledge of keys, such that key
key-management operations and no one components are under the control of at least two
person has access to the authentication people who only have knowledge of their own
materials (for example, passwords or key components; AND
keys) of another.
 Dual control of keys, such that at least two
people are required to perform any key-
management operations and no one person has
access to the authentication materials of another.
3.6.6.b Interview personnel and/or observe Identify the responsible personnel interviewed for
processes to verify that manual clear-text this testing procedure, if applicable.
keys are managed with:
For the interview, summarize the relevant details discussed and/or describe how processes were observed to verify that
 Split knowledge, AND
manual clear-text keys are managed with:
 Dual control
 Split knowledge

 Dual Control

3.6.7 Prevention of unauthorized substitution of cryptographic keys. ☐ ☐ ☐ ☐ ☐

3.6.7.a Verify that key-management Identify the documented key-management Not Mentioned
procedures specify processes to prevent procedures examined to verify that key-management
unauthorized substitution of keys. procedures specify processes to prevent
unauthorized substitution of keys.
3.6.7.b Interview personnel and/or observe Identify the responsible personnel interviewed for
process to verify that unauthorized this testing procedure, if applicable.
substitution of keys is prevented.
For the interview, summarize the relevant details
discussed and/or describe how processes were
observed to verify that unauthorized substitution of
keys is prevented.
3.6.8 Requirement for cryptographic key custodians to formally acknowledge that they understand and accept their key-custodian
responsibilities. ☐ ☐ ☐ ☐ ☐

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 16
 Summary of Assessment Findings
(check one)
PCI DSS Requirements Reporting Details:
In In Place Not Not in
and Testing Procedures Reporting Instruction Assessor’s Response Place w/ CCW N/A Tested Place
3.6.8.a Verify that key-management Identify the documented key-management Not Mentioned
procedures specify processes for key procedures examined to verify that key-management
custodians to acknowledge (in writing or procedures specify processes for key custodians to
electronically) that they understand and acknowledge that they understand and accept their
accept their key-custodian responsibilities. key-custodian responsibilities.
3.6.8.b Observe documentation or other Describe how key custodian acknowledgements or
evidence showing that key custodians other evidence were observed to verify that key
have acknowledged (in writing or custodians have acknowledged that they understand
electronically) that they understand and and accept their key-custodian responsibilities.
accept their key-custodian responsibilities.
3.7 Ensure that security policies and operational procedures for protecting stored cardholder data are documented, in use, and
known to all affected parties. ☐ ☐ ☐ ☐ ☐

3.7 Examine documentation and interview Identify the document reviewed to verify that Not Mentioned
personnel to verify that security policies security policies and operational procedures for
and operational procedures for protecting protecting stored cardholder data are documented.
stored cardholder data are:
Identify the responsible personnel interviewed who
 Documented, confirm that the above documented security policies
 In use, and and operational procedures for protecting stored
cardholder data are:
 Known to all affected parties
 In use
 Known to all affected parties

PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 17
PCI DSS Template for Report on Compliance, Appendix D: Segmentation and Sampling of Business Facilities/System Components June 2018
© 2018 PCI Security Standards Council, LLC. All Rights Reserved. Page 18