Question

A financial services company must generate and store the cryptographic signing keys used for their digital document-signing service. Regulatory auditors require that all key material be generated and stored in hardware validated to FIPS 140-2 Level 3, and the company wants to avoid managing physical hardware while still using Cloud KMS APIs. Which Google Cloud solution meets these requirements with the least operational overhead?

Accepted Answer

Use Cloud HSM to create hardware-backed keys, which are generated and stored in FIPS 140-2 Level 3 validated HSMs managed by Google.

Answer

Use Cloud KMS software-protected keys and enable automatic key rotation to satisfy the auditors.

Answer

Deploy your own HSM appliances on Compute Engine VMs and integrate them with Cloud KMS via a custom connector.

Answer

Use Cloud External Key Manager (EKM) to store keys with a third-party key management partner outside Google Cloud.