PCI Security Standards Council releases key management and operations standard v1.0

What happened

• The PCI Security Standards Council announced its new Key Management and Operations (KMO) Standard v1.0.
• The standard consolidates key‑management requirements across PCI standards, covering design, generation, distribution, use, and retirement of cryptographic keys.
• It adds specific controls for remote and cloud‑based HSMs and initially targets PIN and P2PE keys, with a modular framework for other key types.
• The Council positions KMO as the single source of truth for key‑management compliance across its portfolio.

Why it matters

Entities that already meet PCI PIN or P2PE requirements will need to map their existing controls to the KMO framework and may have to adopt new processes for cloud‑based HSMs. Early alignment can reduce duplicate assessments across PCI standards.

Business impact

Adopting KMO may require updates to key‑management policies, HSM configurations, and audit scopes, affecting compliance costs and timelines.

What to check

1. 1

   Map existing key‑management controls to KMO requirementsHigh priority

   Identify gaps between current PCI PIN/P2PE practices and the new KMO controls.

2. 2

   Update HSM deployment proceduresMedium priority

   Incorporate KMO‑specified security for remote and cloud‑based hardware security modules.

3. 3

   Revise key lifecycle documentationMedium priority

   Ensure key generation, distribution, use, and retirement processes meet KMO specifications.