Where staff perform manual key-management operations involving cleartext keys, key-management policies and procedures must be in place under which those operations are run with dual control and split knowledge. Applicability: applies to manual key-management operations; simply dividing a key into two parts does not comply, and any key component or share has to be generated either by an approved random number generator inside an SCD (an HSM or a point-of-interaction device with PTS approval, for example) OR in line with ISO 19592 or an equivalent standard for secret key share generation. Guidance defines split knowledge (each person holds only their own component, revealing nothing of others or the key) and dual control (two or more people needed to use a key or perform a key function), and warns that in m-of-n schemes a custodian must never know more than one component, now or previously. Examples of manual operations include generation, transmission, loading, storage and destruction. Objective under the customized approach: no one can know a cleartext secret or private key, and no single person can carry out operations involving cleartext keys.
This control maps to 18 controls across 9 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
PCI DSS 4.0 3.7.6 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of PCI DSS 4.0 your existing evidence covers. Hold ISO 27001:2022 and 139 of 280 PCI DSS 4.0 controls already carry evidence.
Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 415 were rejected on the ISO 27001:2022 pair alone.
The graph holds this control, the 18 it maps to, and the evidence behind each claim, over MCP and REST.