1.0

September 12, 2018

http://intranet.company.com/policies/security/pci-dss/keycustodians.html

General Information

Roles

Resources

Processes

Responsibilities

Related Policies

Other Resources

Document Information

This document defines COMPANYNAME's policy for the responsibilities of Key Custodians (KC) as required by the Payment Card Industry's Data Security Standard (PCI DSS).

This policy applies to all Employees, Contractors, Consultants, Outsourcers, and Service Providers of COMPANYNAME who are designated and required to perform in the capacity of a KC.

The Payment Card Industry Data Security Standard^‡ (PCI DSS) is an industry regulation for the protection of sensitive credit card data. Amongst many security requirements, it mandates the encryption of Personal Account Numbers (PAN) when stored on a computerized device. Cryptographic encryption keys used for protecting the information are required to be managed with “appropriate key management” operations as defined in the PCI DSS Key Management (KM) section of Requirements and Security Assessment Procedures, Version 3.2, dated April 2016.

The creation, implementation and any subsequent changes to this policy is the responsibility of the Chief Security Officer (CSO). This policy and any subsequent changes must be approved by two or more of the following officers of the company:

• Chief Executive Officer

• Chief Operating Officer

• Chief Financial Officer

• Chief Legal Officer

• Internal Auditor

Confidential personal information (to be hereinafter called Sensitive Data) is currently defined by the company, to be any one of the following:

• US Social Security Number

• Drivers License or California Identification Card number

• Account number, Credit or Debit Card number in combination with any required security code, access code, or password that would permit access to an individual's financial account

The CSO is the owner of this policy.

The KC is a part owner of the cryptographic keys established by COMPANYNAME to protect Sensitive Data.

The encryption domain administrator (EDA or DA) is the technical administrator of the cryptographic keys and data created and maintained by COMPANYNAME.

Any human user or software application executing on any device that needs to access Sensitive Data is an Authorized User (AU). AUs must be explicitly permitted to perform any function within the cryptographic systems established by COMPANYNAME.

COMPANYNAME has purchased and deployed the StrongKey KeyAppliance (SAKA) to comply with PCI DSS requirements for encryption and key management (EKM). While many of the statements in this policy document are technology-independent, some statements are specific to the implementation chosen by COMPANYNAME and how they are carried out within SAKA.

In the event SAKA conflicts with this policy, COMPANYNAME will work with the vendor to resolve the differences. Where SAKA goes above and beyond this policy, all roles are required to adhere to the requirements of the SAKA implementation.

All Employees, Contractors and Consultants employed by COMPANYNAME are required to comply with this policy, without exception.

The CSO is responsible for:

• Implementing this policy and ensuring it stays current—i.e., it must conform to PCI DSS and other regulations which cover COMPANYNAME's business operations

• Ensuring people in roles related to this policy are trained to comply with this policy

• Providing annual reports to COMPANYNAME's Audit Committee on compliance to this policy

The KC is responsible for:

• Maintaining strict control over the credential/token they are entrusted with to activate the cryptographic module on the SAKA

• Making a complex password—alphabet, numeral, and special characters—with a minimum length of eight (8) characters

• Never revealing their credential password to anyone

• Never handling more than one KC credential at any time

• Never copying anything on the token intended for their credential

• Never copying their credential file to any computer

• Notifying the CSO of any loss of, or compromise to the credential, as soon as feasible

The EDA/DA is responsible for:

• Maintaining strict control over the credential/token they are entrusted with to manage an encryption domain on the SAKA

• Selecting a complex password—alphabet, numeral, and special character—for their credential, of a minimum length of eight (8) characters

• Never revealing their credential password to anyone

• Never handling a KC credential at any time

• Never copying anything on the token intended for their credential

• Never copying their credential file to any computer

• Notifying the CSO of any loss of, or compromise to the credential, as soon as feasible

• Never granting, revoking or modifying privileges to the SAKA without complying with the processes described in this policy

The IA is responsible for:

• Periodically reviewing the SAKA environment for policy compliance

• Notifying the CSO of violations and/or deficiencies in compliance to this policy; In the absence of the CSO rectifying the violation/deficiency within 60 days, the IA will notify COMPANYNAME's Audit Committee of the violation and/or deficiency

Payment Card Industry Data Security Standard

SAKA Documentation

1.0

DRAFT template of policy

John Doe, Legal

John Doe, Legal

Sherlock Holmes, Internal Audit

James T. Kirk, CEO