PCI PIN Security v3.1

PIN Security Requirements:
25-1.1 Designate key custodian(s) for each component, such that the fewest number (e.g., a primary and a backup) of key custodians are assigned as necessary to enable effective key management. Key custodians must be employees or contracted personnel.
Testing Procedures:
25-1.1 Examine key-custodian assignments for each component to verify that: 

PIN Security Requirements:
25-1.2 Document this designation by having each custodian and backup custodian sign a key-custodian form.
Testing Procedures:
25-1.2.a Examine completed key-custodian forms to verify that key custodians sign the form,
25-1.2.b Examine completed key-custodian forms to verify that backup custodians sign the form 

PIN Security Requirements:
25-1.3 Each key-custodian form provides the following: 

25-1.3 Examine all key-custodian forms to verify that they include the following: 

PIN Security Requirements:
25-1.4 In order for key custodians to be free from undue influence in discharging their custodial duties, key custodians sufficient to form the necessary threshold to create a key must not directly report to the same individual except as noted below for organizations of insufficient size.
For example, for a key managed as three components, at least two individuals report to different individuals. In an m-of-n scheme (which must use a recognized secret-sharing scheme such as Shamir), such as three of five key shares to form the key, key custodians sufficient to form the threshold necessary to form the key must not report to the same individual.
The components collectively held by an individual and his or her direct reports shall not constitute a quorum (or shall not provide any information about the value of the key that is not derivable from a single component). 
Custodians must not become a custodian for a component/share of a key where the custodian has previously been or is currently a custodian for another component/share of that key if that would collectively constitute a quorum to form the actual key. 
When the overall organization is of insufficient size such that the reporting structure cannot support this requirement, procedural controls can be implemented. 
Organizations that are of insufficient size that they cannot support the reporting-structure requirement must: 

25-1.4.a Examine key-custodian assignments and organization charts to confirm the following: 

25-1.4.b For organizations that are such a small, modest size that they cannot support the reporting-structure requirement, ensure that documented procedures exist and are followed to: