Which item must be included in the documented crypto architecture for CHD protection?

• A. A list of all employees who handle keys
• B. A network diagram of the data center
• C. Details of algorithms, protocols, and keys used for CHD, including key strength and expiry date
• D. A legal compliance checklist

Answer: (C)

Documenting the exact cryptographic controls used to protect CHD, including which algorithms and protocols are employed and how keys are managed, is what this item requires. This ensures there is a clear, auditable record of how CHD is encrypted or protected in transit and at rest, and how the cryptographic keys are generated, stored, rotated, and retired. Knowing the key strength and expiry date is essential because it shows that keys are robust against attack and that they are periodically refreshed to maintain security over time.

Including a list of employees who handle keys is more about access control than the cryptographic mechanism itself, and a network diagram of the data center, while useful for overall security, does not specify the cryptographic controls protecting CHD. A legal compliance checklist addresses regulatory requirements at a higher level, not the concrete details of the cryptographic architecture used to protect CHD.