What are customer-managed keys?
Customer-managed keys are encryption keys held and controlled by the customer rather than by the vendor processing the data. The vendor's systems request each decryption operation from the customer's key service, which is able to refuse. Withdrawing the key withdraws access, without any dependence on the vendor choosing to act.
Also called: CMK, Bring your own key
Why key custody decides who can end an arrangement
Procurement raises this in the first security questionnaire, and it is one of the few questions with a binary answer. Either the customer holds the key material or the vendor does. Where the vendor holds it, every assurance about data handling depends on the vendor continuing to behave as described. Where the customer holds it, the same assurance is enforced by a system the customer operates.
- Revocation becomes an action the customer takes rather than a request it makes.
- Key usage records give the customer an independent view of access.
- A rotation schedule can be enforced to the customer's own standard.
- Separating custody from processing satisfies a control many auditors test directly.
How customer-managed keys work
- The customer provisions keys in a key service under its own administration.
- The vendor's systems hold data encrypted under those keys and no plaintext copy.
- Each cryptographic operation is requested from the key service and recorded there.
- Grants to the vendor's identities are scoped to specific named operations.
- Rotation produces a new key version while earlier versions remain available for stored data.
- Revoking a grant halts the vendor's ability to decrypt without further negotiation.
How customer-managed keys are evaluated
Keys under customer control are assessed on whether revocation genuinely interrupts access. Verify the following in the deployed environment:
- effect of revoking a grant on live service access
- completeness of key usage records visible to the customer
- presence of any plaintext copy outside the encryption boundary
- scope of the operations each vendor identity may request
- behaviour of stored data across a key rotation
Limitations, risks and common failure modes
- Backups and search indexes are frequently encrypted under a vendor-held key.
- Revocation is documented while nobody has tested it against a live service.
- Key administration is delegated to the vendor during implementation and never reclaimed.
- Usage records are retained by the key service for less time than the data.
- A caching layer holds decrypted content well beyond the point of revocation.