How should access to crypto keys be restricted?

• A. Few custodians necessary
• B. Broad staff access
• C. Anyone with admin rights
• D. All developers

Answer: (A)

Access to crypto keys must be tightly restricted to the fewest custodians necessary to perform the job. Cryptographic keys protect cardholder data, so limiting who can handle or use them dramatically reduces the risk of theft, misuse, or accidental disclosure. Implement controls like dual control (two-person integrity), strong authentication, and comprehensive logging so every key access is authorized and auditable. This approach matches PCI DSS requirements for key management, which demand restricting key access to only those individuals needed for the role and enforcing separation of duties. Broad staff access, admin rights for many, or all developers would significantly raise the chance of misuse or exposure and is not appropriate.