Download Publication

This publication provides updated, comprehensive guidance on how organizations should design, evaluate, and operate Key Management Systems (KMS) in modern cloud environments. 

Building on NISTIR 7956 and other foundational standards, this document explains how traditional key management practices must adapt. Modern practices must account for shared infrastructure, multi-tenancy, and cloud provider trust boundaries. It also highlights how you should drive encryption through clearly defined business needs, rather than assume it as a default.

This publication also explores the four major cloud KMS architecture patterns. These include Cloud-Native, External Key Origination, External KMS, and Multi-Cloud KMS. It also provides practical, cloud-specific guidance for establishing a strong cryptographic key lifecycle, from generation and activation through rotation, archival, recovery, and destruction.

Additionally, this publication explores key management operations, governance controls, and policy requirements. It concludes with forward-looking insights into post-quantum cryptography and the emerging need for crypto-agility.