PCI Requirement 3.5.1 – Maintain a Documented Description of the Cryptographic Architecture
by Randy Bartels / July 28th, 2017
PCI Requirement 3.5.1 is an additional requirement that only applies to service providers. It requires that your organization, “Maintain a documented description of the cryptographic architecture that includes: details of all algorithms, protocols, and keys used for the protection of cardholder data, including key strength and expiry date, a description of the key usage for each key, and an inventory of any HSMs and other SCDs used for key management.”
PCI Requirement 3.5.1 requires some extra effort and diligence surrounding documentation because, according to the PCI DSS, “Maintaining current documentation of the cryptographic architecture enables an entity to understand the algorithms, protocols, and cryptographic keys used to protect cardholder data, as well as the devices that generate, use and protect the keys. This allows an entity to keep pace with evolving threats to their architecture, enabling them to plan for updates as the assurance levels provided by different algorithms/key strengths changes. Maintaining such documentation also allows an entity to detect lost or missing keys or key-management devices, and identify unauthorized additions to their cryptographic architecture.”
During the assessment process, the responsible personnel will be interviewed and documentation will be reviewed in order to validate that your organization’s documentation appropriately describes the cryptographic architecture.
“If your organization is a service provider, Requirement 3.5.1 has an additional set of documented procedures for you. This really requires that you do a little bit of extra diligence around documenting the keys that you use, documenting if you’re using an HSM, documenting what those might look like, who you might share keys with – there’s a great deal of information that you’re asked to keep in addition to just the normal documentation. So, have a look at Requirement 3.5.1, specific to you as service provider. If you have any questions, spend some time with your assessor or QSA. I’m sure they’ll be happy to work you with you to identify what complying with this requirement might look like. “
