PCI PIN Security v3.1

PIN Security Requirements:
9-1 During the process to convey it, any single clear-text secret or private key component/share must at all times be either: 

Note: No single person shall be able to access or use all components or a quorum of shares of a single secret or private cryptographic key.
Testing Procedures:
9-1.a Examine documented procedures for transmission, conveyance, or movement of keys between any two locations to verify that any single clear-text key component must at all times be either:

9-1.b Observe key-management processes, examine associated logs, and interview responsible personnel to verify processes implemented ensure that any single clear-text key component is at all times either: 

PIN Security Requirements:
9-2 Packaging or mailers (i.e., pre-numbered, tamper-evident packaging) containing clear-text key components are examined for evidence of tampering before being opened. Any sign of package tampering indicating a component was potentially compromised must be assessed and the analysis formally documented. If compromise is confirmed, and the result is that one person could have knowledge of the key, it must result in the destruction and replacement of: 

9-2.a Verify documented procedures include requirements for all packaging or mailers containing clear-text key components to be examined for evidence of tampering before being opened.
9-2.b Interview responsible personnel and observe processes to verify that all packaging or mailers containing clear-text key components are examined for evidence of tampering before being opened.
9-2.c Verify documented procedures require that any sign of package tampering is identified, reported, and, if compromise is confirmed, ultimately results in the destruction and replacement of both: 

9-2.d Interview responsible personnel and observe processes to verify that if a package shows signs of tampering indicating a component was potentially compromised, processes are implemented to identify the tampering, report/escalate it, and, if compromise is confirmed, ultimately results in the destruction and replacement of both: 

9-2.e Examine records related to any escalated transmittal events. Verify that if compromise is confirmed it resulted in the destruction and replacement of both: 

PIN Security Requirements:
9-3 Only an authorized key custodian⎯and designated backup(s)⎯shall have physical access to a key component prior to being secured in transmittal packaging and upon removal of a secured key component from transmittal packaging.
Testing Procedures:
9-3.a Verify the existence of a list(s) of key custodians⎯and designated backup(s)⎯authorized to have physical access to key components prior to being secured in transmittal packaging and upon removal of a secured key component from transmittal packaging.
9-3.b Observe implemented access controls and processes to verify that only those authorized key custodians⎯and designated backup(s)⎯have physical access to key components prior to being secured in transmittal packaging and upon removal of a secured key component from transmittal packaging
9-3.c Examine physical access logs (e.g., to security containers for key components) to verify that only the authorized individual(s) have access to each component. 

PIN Security Requirements:
9-4 Mechanisms must exist to ensure that only authorized custodians: 

PIN Security Requirements:
9-5 Pre-numbered, tamper-evident, authenticable bags shall be used for the conveyance of clear-text key components not in an SCD. Out-ofband mechanisms must be used to verify receipt of the appropriate bag numbers.
Note: Numbered courier bags are not sufficient for this purpose
Testing Procedures:
9-5 Verify that pre-numbered, tamper-evident, authenticable bags are used for the conveyance of clear-text key components and perform the following: 

PIN Security Requirements:
9-6 If components or shares of multiple keys are being sent simultaneously between the same sending and receiving custodians, the component/shares for a specific custodian or custodian group can be shipped in the same TEA bag provided that: 

9-6.a If components or shares of multiple keys are being sent simultaneously between the same sending and receiving custodians, the component/shares for a specific custodian or custodian group can be shipped in the same TEA bag provided that: 

9-6.b Examine logs to verify that procedures are followed.