Key block Phase 3 has passed. Prove the migration happened.
Cerenaid records who did what, when, and on which key. The system enforces dual control, and every record goes into an audit chain sealed daily. What comes out is the evidence pack you hand the assessor instead of a binder.
One lifecycle, from the ceremony script to the assessor's desk. Each stage produces a record the next one depends on.
Versioned templates for key generation, load, rotation and component destruction. Print the script for the room; the version hash is on every page.
Every participant checks in from their own phone or tablet with an authenticator code. Each step is timestamped. A dual-control step is submitted by one person and confirmed by a different one, or it does not commit.
Every participant re-authenticates and signs the record as it stands. Completing the ceremony hashes the whole record. Nothing in it can change afterwards.
Sealed records, the custody register, key inventory, the audit chain and a manifest whose SHA-256 hash seals the pack. Verifiable by anyone with a SHA-256 tool; the assessor guide shows how.
Paper proves that a form was signed. Cerenaid proves that the process happened, in order, by the right people, and that nobody changed the record afterwards.
The person who performs a step cannot be the one who confirms it. The system refuses, rather than trusting a witness to remember. Rejections are kept as evidence, not deleted.
Every change carries the hash of the one before it. Sealed daily, with the seal emailed out of the system so you hold an independent copy.
Every component, its custodian, tamper-bag serial number and safe. Deposits, withdrawals and transfers logged with a witness.
Type, algorithm, key block, KCV, cryptoperiod, devices, custodians. Rotation due dates drive reminders and the readiness checklist.
The questions an assessor asks, checked against your records, each with the fix one click away. Not a score.
A Thales ZMK is what Futurex and Atalla call a KEK. Cerenaid speaks the dialect of the HSM you have on record.
Three things that make this year different from the last assessment cycle.
Phase 3 of the PCI PIN key block mandate took effect January 1, 2025: every merchant host, POS device and ATM connection on key blocks. The organizations that met it re-did ceremonies and re-injected devices, and the ones still finishing are doing it now. Either way the next assessment asks for proof. Migration generates ceremonies, and ceremonies generate paperwork.
A PCI PIN assessment every two years is only as good as what you can show. A binder is checked page by page and trusted; an evidence pack is verified in minutes with a SHA-256 tool. When the assessor's time is the scarce resource, the format of the evidence decides how the week goes.
Split knowledge and dual control depend on people doing it right on the day, and the people change. Cerenaid puts the procedure on their phone, refuses the shortcuts, and keeps the record whether or not the custodian who signed it is still with you.
The evidence pack is designed to be checked, not trusted. Every file is listed in a manifest with its SHA-256 hash; the pack hash is the hash of that manifest. When the pack is built, the audit chain is recomputed from its first event and the result goes in the pack. Checking it needs nothing from Cerenaid: any SHA-256 tool, no account, no login.
Read the assessor guide: what is in the pack and how to verify it, step by step.
Institutions that undergo a PCI PIN assessment every two years and currently prove key management with Word, Excel and a safe full of envelopes.
Component custody at volume. The tamper-bag register is the first thing an assessor walks through.
Receive a pack you can verify in minutes instead of a binder you page through for a day. We want your judgment on the format before anyone else's.
Computing KCVs or key blocks. The free tools do that well. Cerenaid is the record, not the arithmetic.
Two design partners at a time. Free for six months, in exchange for weekly feedback and, if it earns it, a reference call. Ideally one acquirer or processor and one QPA firm, so the evidence pack is shaped by the people who produce it and the people who judge it.
Access is by invitation only. There is no self-serve signup and no card.
Prefer email? support@cerenaid.com