Which option best describes Requirement 3.6.3 for key storage?

Which option best describes Requirement 3.6.3 for key storage?

• A. Storing keys on personal laptops.
• B. Storing keys in a public cloud bucket.
• C. Secure cryptographic key storage.
• D. Storing keys in an unencrypted USB drive.

Answer: (C)

Secure cryptographic key storage means protecting the keys used to guard encrypted data so that only authorized systems and people can access them. The idea is to keep keys in a place that is designed specifically for key management, not in general-purpose or easily accessible locations. In practice, this involves using dedicated, protected storage such as hardware security modules (HSMs) or a governed key management system, where keys are stored in encrypted form and access is tightly controlled, audited, and restricted by role. It also means implementing proper key management processes: limiting who can access keys, separating duties so no single person can both access data and keys, logging all key usage, and rotating keys on a defined schedule or after events like personnel changes or suspected compromise. Keys should be stored separately from the data they protect and never in unprotected places. The other options describe storing keys in places that expose them to high risk—on personal laptops, in public cloud storage buckets, or on unencrypted USB drives. Those choices fail to provide the protection, access controls, and auditability required for cryptographic keys, which is why they are not appropriate.

Secure cryptographic key storage means protecting the keys used to guard encrypted data so that only authorized systems and people can access them. The idea is to keep keys in a place that is designed specifically for key management, not in general-purpose or easily accessible locations.

In practice, this involves using dedicated, protected storage such as hardware security modules (HSMs) or a governed key management system, where keys are stored in encrypted form and access is tightly controlled, audited, and restricted by role. It also means implementing proper key management processes: limiting who can access keys, separating duties so no single person can both access data and keys, logging all key usage, and rotating keys on a defined schedule or after events like personnel changes or suspected compromise. Keys should be stored separately from the data they protect and never in unprotected places.

The other options describe storing keys in places that expose them to high risk—on personal laptops, in public cloud storage buckets, or on unencrypted USB drives. Those choices fail to provide the protection, access controls, and auditability required for cryptographic keys, which is why they are not appropriate.