Question

A financial services firm is adopting a SaaS analytics platform that encrypts all tenant data at rest. Regulators require that the firm be able to revoke the provider's ability to decrypt its data at any moment, without waiting on the provider's cooperation. Which key management approach best satisfies this requirement?

Accepted Answer

Use a Hold Your Own Key (HYOK) model where keys remain in the firm's on-premises HSM and are never released to the provider

Answer

Rely on the provider's default provider-managed encryption keys and request key rotation quarterly

Answer

Enable Bring Your Own Key (BYOK) by uploading the firm's key material into the provider's key management service

Answer

Apply client-side field-level tokenization but let the provider manage the tokenization vault