Under 3.6.4, when should cryptographic keys be changed?

Under 3.6.4, when should cryptographic keys be changed?

• A. Rotate keys monthly regardless.
• B. Cryptographic key changes for keys that have reached the end of their cryptoperiod, as defined by the vendor or NIST SP 800-57.
• C. Never change keys.
• D. Change only if someone complains.

Answer: (B)

The key concept here is managing cryptographic keys by their defined lifespan, or cryptoperiod. Keys aren’t meant to be used forever; once a key’s cryptoperiod ends, it should be retired and replaced to limit the impact of any potential compromise and to stay aligned with current security guidance. The best choice matches this idea: change keys when they reach the end of their cryptoperiod, as defined by the vendor or by NIST SP 800-57. NIST provides recommended cryptoperiods based on algorithm and key type, helping ensure keys aren’t used longer than is prudent. PCI DSS expects you to follow these guidelines for key-change timing, applying formal change control when a key’s usable period ends. Rotating keys monthly regardless isn’t necessary or always appropriate, since cryptoperiods vary by algorithm and environment. Never changing keys is insecure, and changing only if someone complains is reactive and unsafe.

The key concept here is managing cryptographic keys by their defined lifespan, or cryptoperiod. Keys aren’t meant to be used forever; once a key’s cryptoperiod ends, it should be retired and replaced to limit the impact of any potential compromise and to stay aligned with current security guidance.

The best choice matches this idea: change keys when they reach the end of their cryptoperiod, as defined by the vendor or by NIST SP 800-57. NIST provides recommended cryptoperiods based on algorithm and key type, helping ensure keys aren’t used longer than is prudent. PCI DSS expects you to follow these guidelines for key-change timing, applying formal change control when a key’s usable period ends.

Rotating keys monthly regardless isn’t necessary or always appropriate, since cryptoperiods vary by algorithm and environment. Never changing keys is insecure, and changing only if someone complains is reactive and unsafe.