PCI PIN Security CO-5: Cryptographic Keys Are Generated Using Approved Methods

All cryptographic keys must be generated within PCI-approved cryptographic devices using approved random number generation, ensuring keys are unique, unpredictable, and of sufficient strength.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Key Management

CO-11 Secret and Private Keys and Key Components Are Generated, Conveyed, and Used in a Manner That Prevents or Detects Their Unauthorized Disclosure, Modification, or Substitution
CO-12 Keys Are Used in a Manner That Prevents or Detects Their Unauthorized Usage
CO-13 Keys Are Administered Throughout Their Lifecycle in a Secure Manner
CO-14 Materials Used to Generate or Transport Keys Are Treated With the Same Security as the Keys They Protect
CO-15 Cryptographic Keys Are Replaced With New Keys When Knowledge of Or Access to a Key Is No Longer Required
CO-16 Keys No Longer Used or Replaced Are Securely Destroyed
CO-6 Cryptographic Keys Are Conveyed or Transmitted Securely
CO-7 Key Loading Is Handled in a Secure Manner

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All PCI PIN Security controls