Circle
Events
Blog

Download Publication

Recommendations for Adopting a Cloud-Native Key Management Service
Recommendations for Adopting a Cloud-Native Key Management Service
Who it's for:
  • Security Architects 
  • IT Analyst 
  • Developers 
  • System Integrators 
  • Compliance Managers 
  • Cybersecurity Professionals 
  • Program and Project Managers 
  • Cloud Customers 

Recommendations for Adopting a Cloud-Native Key Management Service

Release Date: 09/14/2021

Working Group: Cloud Key Management

The purpose of this document is to provide general guidance for choosing, planning, and deploying cloud-native Key Management Systems (KMS). The guidance within will provide recommendations that address technical, operational, legal, regulatory, and financial aspects of leveraging a cloud-native KMS. The goal is to optimize business outcomes, including agility, cost, and compliance. 

This document will help organizations understand how to assess and implement cloud key management services with regard to an organization’s needs for key management. It is then up to the customer to then use encryption keys (or other artifacts, such as secrets) in ways that follow encryption best practices.

Key takeaways:
  1. Learn how to create a list of requirements that the provider can meet. 
  2. When planning for deployment, learn how to create a list of requirements that will be used by the user deploying the cloud-native KMS.
  3. Understand how to perform the processes required to set up the KMS and start utilizing its services.

Help CSA better understand how we can support the cloud community. Answer a couple of questions to download this resource.

In my current job I work in:

CSA is a community driven organization. We would like to send you updates about our ongoing initiatives and opportunities to participate.

By opting into this agreement I am indicating that I want to receive email updates from CSA on related projects. (Marketing purposes, Section 3 of the Privacy Policy).

You’ve made safer cloud computing possible.

Download
Provide feedback on this form

CSA is a community driven organization. We would like to send you updates about our ongoing initiatives and opportunities to participate.

By opting into this agreement I am indicating that I want to receive email updates from CSA on related projects. (Marketing purposes, Section 3 of the Privacy Policy).

Download
Provide feedback on this form

Acknowledgements

Paul Rich Headshot
Paul Rich
Paul Rich

Executive Director, Data Management & Protection

Paul Rich is the executive director, data management and protection for JPMorgan Chase & Co., where he leads the strategy and implementation within the company for unstructured data protection both in the cloud and on-premises. He is the co-chair of the CSA Cloud Key Management Working Group, which he envisions as a means of hearing diverse perspectives on the use of cloud services and expectations for both data privacy and secu...

Read more

Michael Roza Headshot
Michael Roza
Michael Roza

Risk, Audit, Control and Compliance Professional

Michael Roza is a risk, audit, control and compliance professional with 20-plus years of experience with organizations such as Bridgestone EMEA, Komatsu International, Mitsui Novus International, Johnson and Johnson Inc., and Baxter, Inc. Within CSA, he has served as lead author/contributor for 11 projects completed by CSA’s Internet of Things, Blockchain/Distributed Ledger, Top Threats, Cloud Control Matrix, and Software-Defined P...

Read more

Mike Schrock Headshot
Mike Schrock
Mike Schrock

Senior Director Global Business Development – Cloud Strategy

Mike Schrock joined Thales Group (formally Gemalto) in 2015 as the Senior Director, Business Development, managing Cloud Service Provider Strategy. Mr. Schrock is passionate about and has championed digital transformation for over twenty years in his technology alliance and executive management experience, particularly in the digital, cloud and network security, internet and mobile sectors. Prior to joining Gemalto, he held executive roles ...

Read more

Vani Murthy Headshot
Vani Murthy
Vani Murthy

Senior advisor Security & Compliance at Akamai Technologies

Vani is an active contributor to several Cloud Security Alliance working groups, including Application Containers and Microservices, Serverless, Top threats, Cloud Control Matrix (CCMv4), SDP Expert Group (Advisory Group to the Office of the CTO), Cloud Key Management etc. Vani has co-authored publications such as "How to Design a Secure Serverless Architecture", "CCM v4.0 Implementation Guidelines", "Cloud Top Threats". She has...

Read more

Are you a research volunteer? Request to have your profile displayed on the website here.

Interested in helping develop research with CSA?