PCI PIN Security CO-15: Cryptographic Keys Are Replaced With New Keys When Knowledge of Or Access to a Key Is No Longer Required

Cryptographic keys must be replaced when there is suspected or known compromise, when custodians leave their roles, or when the cryptoperiod expires. Replacement must use approved methods.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Key Management

CO-11 Secret and Private Keys and Key Components Are Generated, Conveyed, and Used in a Manner That Prevents or Detects Their Unauthorized Disclosure, Modification, or Substitution
CO-12 Keys Are Used in a Manner That Prevents or Detects Their Unauthorized Usage
CO-13 Keys Are Administered Throughout Their Lifecycle in a Secure Manner
CO-14 Materials Used to Generate or Transport Keys Are Treated With the Same Security as the Keys They Protect
CO-16 Keys No Longer Used or Replaced Are Securely Destroyed
CO-5 Cryptographic Keys Are Generated Using Approved Methods
CO-6 Cryptographic Keys Are Conveyed or Transmitted Securely
CO-7 Key Loading Is Handled in a Secure Manner

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI PIN Security controls