2.3.2 For wireless environments connected to the CDE or transmitting account data, wireless encryption keys are changed when personnel with knowledge of the keys leave the company or the role for which the keys were used changes.

Defined Approach Requirements

2.3.2 For wireless environments connected to the CDE or transmitting account data, wireless encryption keys are changed when personnel with knowledge of the keys leave the company or the role for which the keys were used changes.

Customized Approach Objective

Wireless encryption keys are changed when the risk of their exposure increases.

Defined Approach Testing Procedures

2.3.2.a Examine policies and procedures to verify they define the following:

• Procedures for changing wireless encryption keys when personnel with knowledge of the keys leave the company or the role for which the keys were used changes.
• The frequency of changing encryption keys.

2.3.2.b Interview personnel and examine records to verify that encryption keys are changed when personnel with knowledge of the keys leave the company or the role for which the keys were used changes.

Purpose

Changing wireless encryption keys when individuals with knowledge of the keys leave the organization or change positions helps to ensure that the keys are known only to authorized personnel.

Good Practice

Entities should also change encryption keys when they suspect the keys may have been disclosed to unauthorized individuals or otherwise compromised.

Individuals with knowledge of encryption keys include employees, contractors, and service providers.