Which statement is NOT an acceptable form for storing secret and private keys used to encrypt/decrypt cardholder data?

Which statement is NOT an acceptable form for storing secret and private keys used to encrypt/decrypt cardholder data?

• A. Encrypted with a KEK and stored separately.
• B. Stored within a secure cryptographic device.
• C. As at least two full-length key components or key shares.
• D. Stored in plaintext on a workstation.

Answer: (D)

Protecting secret and private keys requires strong key management that prevents exposure. The acceptable approaches include encrypting keys with a key-encrypting key (KEK) and storing them separately, or keeping keys inside a secure cryptographic device like an HSM that provides tamper resistance and controlled access, or splitting key material into multiple shares for dual-control. Storing keys in plaintext on a workstation defeats these protections because a compromised workstation can expose the keys and allow decrypting cardholder data, lacking encryption at rest, tamper resistance, and proper access controls. Therefore, plaintext on a workstation is not an acceptable form for storing secret and private keys.

Protecting secret and private keys requires strong key management that prevents exposure. The acceptable approaches include encrypting keys with a key-encrypting key (KEK) and storing them separately, or keeping keys inside a secure cryptographic device like an HSM that provides tamper resistance and controlled access, or splitting key material into multiple shares for dual-control. Storing keys in plaintext on a workstation defeats these protections because a compromised workstation can expose the keys and allow decrypting cardholder data, lacking encryption at rest, tamper resistance, and proper access controls. Therefore, plaintext on a workstation is not an acceptable form for storing secret and private keys.