PCI Sample Encryption Key Management Documentation

In the four years since merchants were required to comply with the Payment Card Industry Data Security Standards (PCI-DSS), CTG has found many clients still struggling with encryption implementation. While many have successfully deployed various encryption products to protect customer payment data these implementations often lack the proper documentation with regard to the encryption key management.

The following is a sample set of encryption key management procedures for a fictitious application. These can be used as a guide to create encryption key management documentation for other applications that would be compliant with PCI DSS requirement 3.6.

Download the material in PDF format here.