PCI PIN Security CO-13: Keys Are Administered Throughout Their Lifecycle in a Secure Manner

Key administration procedures must cover the entire key lifecycle from generation through destruction, with appropriate controls at each stage to prevent compromise.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Key Management

CO-11 Secret and Private Keys and Key Components Are Generated, Conveyed, and Used in a Manner That Prevents or Detects Their Unauthorized Disclosure, Modification, or Substitution
CO-12 Keys Are Used in a Manner That Prevents or Detects Their Unauthorized Usage
CO-14 Materials Used to Generate or Transport Keys Are Treated With the Same Security as the Keys They Protect
CO-15 Cryptographic Keys Are Replaced With New Keys When Knowledge of Or Access to a Key Is No Longer Required
CO-16 Keys No Longer Used or Replaced Are Securely Destroyed
CO-5 Cryptographic Keys Are Generated Using Approved Methods
CO-6 Cryptographic Keys Are Conveyed or Transmitted Securely
CO-7 Key Loading Is Handled in a Secure Manner

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI PIN Security controls