PCI PIN Security CO-16: Keys No Longer Used or Replaced Are Securely Destroyed

Cryptographic keys that are no longer required or have been replaced must be securely destroyed in a manner that ensures the keys and any associated material cannot be recovered.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Key Management

CO-11 Secret and Private Keys and Key Components Are Generated, Conveyed, and Used in a Manner That Prevents or Detects Their Unauthorized Disclosure, Modification, or Substitution
CO-12 Keys Are Used in a Manner That Prevents or Detects Their Unauthorized Usage
CO-13 Keys Are Administered Throughout Their Lifecycle in a Secure Manner
CO-14 Materials Used to Generate or Transport Keys Are Treated With the Same Security as the Keys They Protect
CO-15 Cryptographic Keys Are Replaced With New Keys When Knowledge of Or Access to a Key Is No Longer Required
CO-5 Cryptographic Keys Are Generated Using Approved Methods
CO-6 Cryptographic Keys Are Conveyed or Transmitted Securely
CO-7 Key Loading Is Handled in a Secure Manner

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI PIN Security controls