How Often Should Encryption Keys Be Rotated

Rotation typeFrequencyPolicy-based key rotationIntervals of 30 days (in other words, every 30 days, or 60 days, or 90 days, etc)Manual key rotationUp to one rotation per hour

When must cryptographic keys be changed?

When we specifically look at the requirements within 3.6, it states that you must rotate the keys at the end of their defined cryptoperiod. So if you’re using encryption in your environment, your assessor should be asking what your defined cryptoperiod is.

How are the encryption keys managed?

The encryption key is created and stored on the key management server. The key manager creates the encryption key through the use of a cryptographically secure random bit generator and stores the key, along with all it’s attributes, into the key storage database.