What is required of cryptographic key custodians under the key management requirements?

• A. Attend annual security training.
• B. Formally acknowledge understanding and acceptance of their key-custodian responsibilities.
• C. Encrypt all keys with AES-256.
• D. Store copies of keys in a central repository.

Answer: (B)

In PCI DSS, giving someone the role of key custodian comes with explicit accountability for protecting cryptographic material. Requiring the custodian to formally acknowledge, in writing, that they understand and accept their responsibilities creates a verifiable commitment. It makes clear who is responsible for following key-management procedures, safeguarding keys, controlling access, and reporting incidents, and it gives auditors a tangible document to review.

Other options, while potentially part of broader security programs, do not fulfill this specific requirement. Attending annual security training is useful but not the formal written acknowledgment that establishes custodian accountability. Encrypting all keys with a particular algorithm is a technical control choice rather than a documented accountability obligation. Storing copies of keys in a central repository isn’t the mandated custodian obligation and can raise risks if not properly controlled; the standard emphasizes proper custody and access controls rather than centralized duplication.