PCI PIN Security CO-14: Materials Used to Generate or Transport Keys Are Treated With the Same Security as the Keys They Protect

Smart cards, paper components, and other materials used to generate or transport cryptographic keys must be treated with the same security controls as the keys themselves, including dual control and secure storage.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Key Management

CO-11 Secret and Private Keys and Key Components Are Generated, Conveyed, and Used in a Manner That Prevents or Detects Their Unauthorized Disclosure, Modification, or Substitution
CO-12 Keys Are Used in a Manner That Prevents or Detects Their Unauthorized Usage
CO-13 Keys Are Administered Throughout Their Lifecycle in a Secure Manner
CO-15 Cryptographic Keys Are Replaced With New Keys When Knowledge of Or Access to a Key Is No Longer Required
CO-16 Keys No Longer Used or Replaced Are Securely Destroyed
CO-5 Cryptographic Keys Are Generated Using Approved Methods
CO-6 Cryptographic Keys Are Conveyed or Transmitted Securely
CO-7 Key Loading Is Handled in a Secure Manner

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI PIN Security controls