Imprint and compliant mode were added to indirectly and directly meet the PCI-HSM PIN  Transaction Security v3.0, 2016 requirement. TKE is required to manage Host Crypto  Module domains in imprint and compliant mode. Domains in imprint mode or compliant mode on a Crypto Express6S maintain a  domain-specific module audit log. The TKE provides a feature for downloading the audit  records so they can be viewed. Domains in imprint mode or compliant mode on a Crypto Express6S must be managed by  using domain-specific roles and authorities. The TKE provides new management features  for the domain-specific roles and authorities. The roles are subject to forced dual control  policies that prevent roles from issuing and co-signing a command. For information about  how to manage imprint and compliant mode domains, see the TKE User’s Guide. To simplify the management of a compliant domain, the TKE provides a setup wizard that  creates a minimum set of forced dual control roles and authorities that are needed to  manage a compliant domain. For more information about how to manage imprint and  compliant mode domains, see the TKE User’s Guide. Tip:  For more information about handling a TKE, see the TKE Introduction video. If one or more LPARs are configured to use Crypto Express coprocessors, the TKE  workstation can be used to manage DES, AES, ECC, and PKA master keys. This  management can be done for all cryptographic domains of each Crypto Express coprocessor  feature that is assigned to the LPARs that are defined to the TKE workstation. Each LPAR in the same system that uses a domain that is managed through a TKE  workstation connection is a TKE host or TKE target. An LPAR with a TCP/IP connection to the  TKE is referred to as the  TKE host ; all other partitions are  TKE targets . The cryptographic controls that are set for an LPAR through the SE determine whether the  workstation is a TKE host or a TKE target. An optional smart card reader (FC 0895) can be added to the TKE workstation. One FC 0895  includes two smart card readers, two cables to connect them to the TKE workstation, and 20  smart cards. The reader supports the use of smart cards that contain an embedded  microprocessor and associated memory for data storage. The memory can contain the keys  to be loaded into the Crypto Express features. These readers can be used with smart cards  only that have applets that were loaded from a TKE 8.1 or later. These cards are FIPS  certified. 6.6.2 Optional smart card reader 6.6.1 Logical partition, TKE host, and TKE target GLYPH<SM590000> Set clock With TKE 9.0, the host crypto module’s cloc k can be set. The clock must be set before a  domain can be placed in imprint mode. GLYPH<SM590000> Domain-specific Host Crypto Module Audit Log management GLYPH<SM590000> Domain-specific roles and authorities GLYPH<SM590000> Setup PCI Environment Wizard Chapter 6. Cryptographic features  247