Encryption checklist signed off pre-deployment

PCI-DSS 4.0 Req-12.3 requires that security controls be formally reviewed before deployment to cardholder data environments. NIST CA-6 requires authorization of information system operation — the ATO (Authority to Operate) concept applied to encryption controls. An encryption checklist with sign-off is the artifact that proves this review occurred; without it, every production deployment is an unreviewed change to the cardholder data environment. FFIEC IT Handbook Information Security procedures explicitly require pre-deployment review gates. A checklist without a sign-off record is indistinguishable from a checklist that was never reviewed — the dated signature is the control, not the document itself.

Create docs/deploy-checklist.md with encryption-specific items and a sign-off section. Reference it from your deployment runbook and enforce it as a required PR checklist item:

# Pre-Deployment Encryption Checklist

## Deployment: v[X.Y.Z] — [date]

- [ ] All sensitive columns encrypted at rest (AES-256+) — verified in `src/lib/encryption.ts`
- [ ] TLS 1.2+ minimum version confirmed in nginx/load balancer config
- [ ] Certificate validation enabled for all payment processor calls
- [ ] Encryption keys loaded from KMS, not from codebase or committed `.env`
- [ ] Key rotation policy active (automatic or manual within 365 days)
- [ ] Backup encryption enabled and last verified within 180 days
- [ ] KMS audit logging enabled and last reviewed within 90 days
- [ ] No PII in logging statements (grep for `ssn`, `accountNumber`, `cardToken`)

## Sign-off
- Reviewed by: ____________________
- Date: ____________________
- Deployment authorized: [ ] Yes  [ ] No — blocked pending: ____________________

Store completed checklists as dated files (docs/deploy-signoffs/2026-04-18.md) so the history is auditable.