PCI SSC Introduces Key Management and Operations (KMO) Standard v1.0

What Happened

On October 7, 2026, the PCI Security Standards Council (PCI SSC) announced the publication of its newest standard, the Key Management and Operations (KMO) Standard v1.0. The announcement came through the organization's official podcast series, *Coffee with the Council*, hosted by Alicia Malone, Director of Communications and Public Relations. The episode features Andrew Jamieson, VP Distinguished Standards Architect at PCI SSC, who explains the purpose and scope of the new standard.

The KMO Standard is designed to address a long-standing gap in the payments industry: while PCI DSS and other PCI standards reference cryptographic key management requirements, there has not been a dedicated, standalone standard that provides comprehensive operational guidance for managing cryptographic keys throughout their entire lifecycle. KMO v1.0 fills that gap by establishing a formalized framework for key generation, distribution, storage, rotation, retirement, and destruction.

What the KMO Standard Covers

According to the podcast discussion, the KMO Standard focuses on several critical domains:

• Key lifecycle management — explicit controls for every phase of a cryptographic key's existence, from creation through decommissioning
• Roles and responsibilities — clear separation of duties for personnel who manage, access, and use cryptographic keys
• Key storage and protection — requirements for securing keys at rest, in transit, and in use, including hardware security modules (HSMs) and key management systems
• Key inventory and documentation — mandates for maintaining comprehensive inventories of cryptographic assets and associated metadata
• Incident response for key compromise — procedures for detecting, responding to, and recovering from key-related security incidents
• Audit and compliance mapping — alignment with existing PCI DSS requirements, particularly Requirement 3 (protect stored account data) and Requirement 4 (encrypt transmission of cardholder data across open, public networks)

Who Is Affected

The KMO Standard is relevant to a broad range of organizations in the payment ecosystem:

• Merchants and service providers that process, store, or transmit cardholder data and use encryption, tokenization, or other cryptographic controls
• Acquirers and issuers that manage cryptographic keys for payment processing, PIN encryption, and card production
• Third-party security assessors (QSAs and ASVs) who evaluate compliance against PCI standards
• Technology vendors that develop payment hardware, software, and key management solutions
• Cloud service providers that host payment workloads and manage customer-managed encryption keys

While KMO v1.0 is a standalone standard, it is designed to complement — not replace — existing PCI DSS requirements. Organizations that already comply with PCI DSS v4.x will find that KMO formalizes and expands upon the cryptographic key management expectations embedded in those requirements.

Compliance Implications

The introduction of the KMO Standard has several significant compliance implications:

1. Increased scrutiny on cryptographic key management — Assessors will likely reference KMO guidance when evaluating an organization's key management practices during PCI DSS assessments.

2. Formalized expectations — What was previously interpreted as "good practice" under PCI DSS Requirement 3.6 and 3.7 is now codified in a dedicated standard, reducing ambiguity.

3. Potential future integration — PCI SSC has historically introduced standalone standards that later influence updates to the core PCI DSS framework. Organizations should anticipate that KMO concepts may be incorporated into future PCI DSS revisions.

4. Vendor management considerations — Organizations that rely on third-party key management services will need to verify that their vendors' practices align with KMO requirements.

5. Documentation burden — KMO emphasizes comprehensive key inventories, policy documentation, and audit trails, which may require additional investment in governance and record-keeping.

What Organizations Should Do

Organizations should take the following steps to prepare for KMO adoption:

1. Review the Standard

Download and review the KMO Standard v1.0 from the PCI SSC website. Pay particular attention to the control objectives and how they map to your existing PCI DSS compliance program.

2. Conduct a Cryptographic Asset Inventory

Document all cryptographic keys, certificates, HSMs, and key management systems in use across your environment. Identify key owners, usage purposes, algorithms, key strengths, and rotation schedules.

3. Gap Assessment

Compare your current key management practices against KMO requirements. Identify gaps in areas such as key rotation frequency, separation of duties, key destruction procedures, and incident response readiness.

4. Update Policies and Procedures

Revise your cryptographic key management policy to incorporate KMO control objectives. Ensure that roles and responsibilities are clearly defined and that procedures are documented for all key lifecycle phases.

5. Engage with Assessors

Discuss the KMO Standard with your QSA or internal compliance team to understand how it may affect upcoming assessments and whether early adoption is advisable for your organization.

6. Monitor PCI SSC Guidance

Stay informed about additional PCI SSC publications, implementation guides, and training resources related to KMO. The Council is expected to release supplementary materials to support adoption.

Looking Ahead

The KMO Standard v1.0 represents a significant step forward in the PCI SSC's efforts to strengthen cryptographic controls across the payments industry. As organizations digest the new requirements and integrate them into their existing compliance programs, those that move early will be better positioned to demonstrate robust key management practices and reduce their exposure to cryptographic failures and key-related security incidents.