Key Responsibility Models
Released: 12/10/2025
This infographic offers a clear understanding of how cloud service providers and customers share responsibilities for cloud key management.
Cloud key management approaches include Bring Your Own Key (BYOK), Hold Your Own Key (HYOK), Provider-Managed Key (PMK), and Customer-Managed Key (CMK). As vendors increasingly use these terms inconsistently, organizations struggle to determine who is responsible for key generation, storage, usage, access, rotation, and auditing. This infographic resolves that confusion by mapping these activities across the major key responsibility models. The goal is to help stakeholders select the right approach for their security, compliance, and operational needs.
The first page provides high-level architectural definitions of CMKs, BYOK, HYOK, and PMKs, along with emerging hybrid patterns. The second page features a matrix that compares responsibilities across each stage of the key lifecycle. This practical reference chart helps teams designing cryptographic controls, meeting regulatory requirements, or planning for evolving technologies such as post-quantum cryptography.
Key Takeaways:
- Clear definitions of PMK, CMK, BYOK, HYOK, and hybrid key responsibility models
- Provider vs. customer responsibilities across the key lifecycle
- How to align security controls with standards and regulatory requirements (e.g., FIPS 140-3, NIST SP 800-57, HIPAA, PCI DSS)
Topics:
Download this Resource
Prefer to access this resource without an account? Download it now.
Best For:
- Cloud Security Architects
- CISOs and Security Leaders
- Compliance & Risk Management Professionals
- Cloud Infrastructure & Operations Teams
- Cryptography and Key Management Engineers
