If manual clear text key mgmt is used, what enforcement is required?

• A. Split knowledge and dual control
• B. One-person control is sufficient
• C. No controls needed
• D. Anyone with a password can access

Answer: (A)

When you manage encryption keys in clear text by hand, you introduce a high risk that a single person could misuse or expose the keys. To counter that risk, the controls require split knowledge and dual control for key management. This means the key’s handling is divided among multiple people and sensitive actions to generate, store, rotate, or use the key require at least two individuals to cooperate. No single person should have full access or the ability to perform critical steps alone. This approach minimizes insider threat and reduces the chance of an accidental or deliberate disclosure of cardholder data.