Question

A financial services company stores highly sensitive customer records in a cloud-hosted database. Regulators require that the organization retain full control over the master key used to protect the data, that the master key never leave a FIPS 140-2 Level 3 boundary, and that individual data-encryption keys be rotatable without re-encrypting the entire dataset. Which data-at-rest design BEST satisfies all three requirements?

Accepted Answer

Implement envelope encryption where data-encryption keys are wrapped by a customer-controlled master key stored in a dedicated HSM/KMS, using bring-your-own-key (BYOK) or hold-your-own-key

Answer

Enable the cloud provider's default server-side encryption using provider-managed keys and rely on the provider's shared HSM infrastructure

Answer

Encrypt all records directly with a single AES-256 master key stored in an application configuration secret and rotate the secret quarterly

Answer

Use transparent database encryption with keys escrowed by the cloud provider and enable automatic annual key rotation