PCI DSS 3.7.7: Prevent Unauthorized Key Substitution

What this means

Control 3.7.7 mandates that organizations implement safeguards to prevent the unauthorized substitution or replacement of cryptographic keys throughout their lifecycle. This includes protecting keys during generation, storage, transmission, and use. The control ensures that only authorized, legitimate keys are used for encryption and decryption operations, preventing attackers from introducing compromised or rogue keys that could decrypt sensitive cardholder data or bypass security controls.

How to comply

1. 1.Implement key management systems (KMS) that authenticate and authorize all key operations, preventing unauthorized substitution attempts
2. 2.Use cryptographic hardware security modules (HSMs) to store and manage keys in tamper-resistant environments where substitution is physically prevented
3. 3.Establish strict key versioning and tracking procedures that create an audit trail of all key creation, modification, and rotation events
4. 4.Implement digital signatures or cryptographic integrity checks on key data to detect unauthorized modifications or replacements
5. 5.Enforce strong access controls limiting key management activities to authorized personnel with documented need-to-know
6. 6.Conduct regular key integrity validation checks to verify that stored and deployed keys have not been altered or substituted
7. 7.Define and test incident response procedures specifically for detecting and responding to potential key substitution attempts

Evidence auditors look for

• HSM configuration documentation showing secure key storage and authentication mechanisms
• Key management policy defining authorization requirements for all key lifecycle operations
• Access control logs demonstrating restricted permissions for key generation, storage, and deployment
• Key integrity audit logs showing regular validation checks and their results
• Digital signature or HMAC records verifying key authenticity and detecting substitution attempts
• Key rotation reports documenting old keys decommissioned and new keys securely deployed
• Incident response plan with specific procedures for key substitution detection and remediation
• Third-party HSM or KMS vendor attestation confirming anti-substitution technical controls

Frequently asked questions

GRCWatch automates key management audit trails and detects configuration drift in HSM and KMS environments, alerting you to unauthorized key modifications or access attempts before substitution can occur.

See how GRCWatch handles this control automatically

Related controls