Question

A multinational bank must store customer records in Cloud Storage and BigQuery. A new regulatory requirement mandates that the bank retain sole control of the encryption keys outside of Google Cloud, so that Google can never access key material even under a lawful access request. The security team also needs the ability to instantly and permanently revoke Google's ability to decrypt the data. Which encryption approach satisfies these requirements?

Accepted Answer

Use Cloud External Key Manager (Cloud EKM) with keys held in an approved external key management partner controlled by the bank.

Answer

Use Google-managed default encryption and rely on Google's data residency guarantees for the region.

Answer

Use customer-managed encryption keys (CMEK) with keys stored in Cloud KMS in the same region as the data.

Answer

Use customer-supplied encryption keys (CSEK) uploaded to Cloud KMS and rotated automatically by Google.