PCI SSC publishes Key Management and Operations (KMO) Standard v1.0
PCI SSC released the Key Management and Operations (KMO) Standard v1.0, which consolidates key management requirements and introduces new requirements for cloud-based HSMs and software-based cryptography. The standard initially focuses on PIN and P2PE keys.
- Framework
- PCI DSS
- Who it concerns
- Entities that manage cryptographic keys for PIN and P2PE data, including those using cloud-based HSMs or software-based cryptography.
What changed?
Each point with the sentence from the source that says it.
The KMO Standard details requirements for secure management and operations using cryptographic keys, covering design, generation, loading, distribution, use, retirement, replacement, and destruction.
The standard details the requirements for secure management and operations using cryptographic keys, covering everything from the design of the key management system, through to the generation and loading of keys, the distribution of those keys, the use of the keys, and then finally through to retirement, replacement, and destruction.
KMO introduces new requirements for secure operation of remote and cloud-based HSMs, as well as physical and logical security of key management and operation environments.
KMO also introduces new requirements for secure operation of remote and cloud-based HSMs (Hardware Security Module), as well as physical and logical security of key management and operation environments.
KMO includes a new approach to software-based cryptography, boiling down P2PE requirements to five requirements to simplify use and operation.
There's also a new approach to software-based cryptography in KMO, where you might have, for example, a derivation key that exists in an HSM. Then you have transaction unique keys that come out of the HSM that can be used perhaps in the server, that is allowed in P2PE, but there's actually quite a large section of P2PE that talks to these implementations. We've boiled all of that down to basically five requirements, a handful of requirements, in KMO to help simplify the use and operation in that context.
KMO requires that every key has a defined crypto period and that key owners have a program to monitor changes in the cryptographic threat landscape and make appropriate changes.
So, in KMO, we do require that every key has a defined crypto period, a period at which it can be used. And the key owners have a program in place to actively monitor the changes in the cryptographic threat landscape and make appropriate changes in the key management systems as that threat landscape changes.
Which policies should you review?
Suggested from the change above. Check the source before you edit.
- Encryption Policy
Review the Encryption Policy to align key management practices with the KMO Standard, including crypto periods, threat monitoring, and requirements for cloud-based HSMs and software-based cryptography.
- Vendor & Third-Party Management Policy
Update the Vendor & Third-Party Management Policy to address the use of KMO-assessed services and cloud-based HSM providers.