An enterprise is storing sensitive customer analytics datasets across Google Cloud storage and data services, such as BigQuery and Cloud Storage. While Google Cloud encrypts all data at rest by default, the company's regulatory compliance mandate requires the security team to maintain direct control over key rotation schedules, audit key usage, and immediately revoke access to data by disabling keys if a security incident occurs. Which encryption strategy should the organization implement to meet these compliance requirements?

Implement Customer-Managed Encryption Keys (CMEK) using Cloud Key Management Service (Cloud KMS).: ### What Customer-Managed Encryption Keys (CMEK) are **Customer-Managed Encryption Keys (CMEK)** allow organizations to use **Cloud Key Management Service (Cloud KMS)** to create, manage, rotate, and control cryptographic keys that protect data stored at rest in Google Cloud services such as **BigQuery**, **Cloud Storage**, **Cloud SQL**, and **Persistent Disk**. ### How CMEK meets the requirements - **Granular lifecycle control (✓):** The organization controls the key lifecycle directly in **Cloud KMS**, enabling automated or manual key rotation schedules according to enterprise security policies. - **Immediate access revocation (✓):** Disabling or destroying a key in **Cloud KMS** instantly prevents services from decrypting underlying data, effectively revoking access to stored datasets during security incidents. - **Auditability and governance (✓):** All cryptographic operations (encrypt, decrypt) performed with the key are logged in **Cloud Audit Logs**, providing verifiable compliance trails. - **Native service integration (✓):** Integrates seamlessly across core Google Cloud data services by granting service agents the **CryptoKey Encrypter/Decrypter** role. ### Key advantages of CMEK - **Separation of duties:** Enables security administrators to manage encryption keys separately from data engineers who manage datasets and storage resources. - **Centralized key management:** Manages software keys, hardware security modules (**Cloud HSM**), or external keys (**Cloud EKM**) within a single unified API. - **FIPS 140 compliance:** Supports regulatory compliance standards requiring organization-controlled key lifecycles. - **No overhead of managing raw keys on-premises:** Keys are securely stored and utilized within Google Cloud without requiring local key generation infrastructure. ### Why this is optimal CMEK represents the industry-standard approach when organizations must comply with stringent regulatory frameworks that mandate customer control over encryption keys, while still leveraging the scalability, performance, and native functionality of Google Cloud managed services.