Question

A financial services company must comply with a regulatory requirement that all cryptographic keys protecting customer payment data be generated and stored in hardware validated to FIPS 140-2 Level 3. The security team wants to use Cloud KMS to manage these keys but must ensure the private key material never exists outside a certified hardware boundary and cannot be exported. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Create keys in Cloud HSM (a key ring with the HSM protection level), which generates and stores key material in FIPS 140-2 Level 3 validated hardware security modules

Answer

Create keys in a Cloud KMS key ring using the software protection level and enable key rotation every 90 days

Answer

Generate keys on-premises in an HSM appliance and import the wrapped key material into Cloud KMS as external keys

Answer

Use customer-supplied encryption keys (CSEK) so the company retains full control of the raw key material