Regarding 3.6.5, what is required when keys are retired or replaced and possibly retained?

Regarding 3.6.5, what is required when keys are retired or replaced and possibly retained?

• A. Delete keys immediately without archiving.
• B. Archive keys for decryption/verification only as appropriate.
• C. Share archived keys with contractors.
• D. Keep keys in an unprotected plain text file.

Answer: (B)

When cryptographic keys are retired or replaced, you don’t just discard them if there might be data that was encrypted with them. The right approach is to archive those keys securely, so they can be used for decryption or verification of existing data if needed. This archiving must be done under strong controls—appropriate access restrictions, encryption at rest, integrity protections, and audit logs—and you keep them only as long as there is a legitimate need to decrypt or verify retained data. This ensures you can access historical information or verify past transactions while keeping the keys protected from unauthorized access. Deleting keys immediately would remove any possibility of recovering encrypted data. Sharing archived keys with contractors would weaken security through broad access. Storing keys in an unprotected plain text file is insecure. Archive, protect, and limit access to keys only for the purpose of future decryption or verification.

When cryptographic keys are retired or replaced, you don’t just discard them if there might be data that was encrypted with them. The right approach is to archive those keys securely, so they can be used for decryption or verification of existing data if needed. This archiving must be done under strong controls—appropriate access restrictions, encryption at rest, integrity protections, and audit logs—and you keep them only as long as there is a legitimate need to decrypt or verify retained data. This ensures you can access historical information or verify past transactions while keeping the keys protected from unauthorized access.

Deleting keys immediately would remove any possibility of recovering encrypted data. Sharing archived keys with contractors would weaken security through broad access. Storing keys in an unprotected plain text file is insecure. Archive, protect, and limit access to keys only for the purpose of future decryption or verification.