Which practice best aligns with Requirement 3.5.3 for cryptographic keys?

Which practice best aligns with Requirement 3.5.3 for cryptographic keys?

• A. Store cryptographic keys in the fewest possible locations.
• B. Store cryptographic keys in multiple locations to ensure redundancy.
• C. Archive keys off-site in unencrypted form.
• D. Distribute keys to development machines.

Answer: (A)

Minimizing where cryptographic keys are stored is the core idea here. Keeping keys in as few locations as possible reduces the attack surface and makes it much easier to enforce strict access controls, monitor usage, and perform secure key rotation and revocation. Centralized, well-protected storage—often within a dedicated key management solution or hardware security module—limits exposure and helps ensure keys aren’t copied or exposed across unnecessary systems. Storing keys in multiple locations raises risk because each additional copy becomes a potential point of compromise and complicates control over who can access or alter them. Archiving keys off-site in unencrypted form creates a clear vulnerability: anyone who gains access to that archive could read the keys. Distributing keys to development machines spreads sensitive material into less-secure environments, increasing the likelihood of exposure and improper handling. So, the choice that aligns with secure key management practices is to keep cryptographic keys in the fewest possible locations.

Minimizing where cryptographic keys are stored is the core idea here. Keeping keys in as few locations as possible reduces the attack surface and makes it much easier to enforce strict access controls, monitor usage, and perform secure key rotation and revocation. Centralized, well-protected storage—often within a dedicated key management solution or hardware security module—limits exposure and helps ensure keys aren’t copied or exposed across unnecessary systems.

Storing keys in multiple locations raises risk because each additional copy becomes a potential point of compromise and complicates control over who can access or alter them. Archiving keys off-site in unencrypted form creates a clear vulnerability: anyone who gains access to that archive could read the keys. Distributing keys to development machines spreads sensitive material into less-secure environments, increasing the likelihood of exposure and improper handling.

So, the choice that aligns with secure key management practices is to keep cryptographic keys in the fewest possible locations.