Entity’s Senior Management or the Information Security Officer periodically reviews and approves the list of people with access to the encryption keys