An enterprise is planning to store sensitive analytics data in Google Cloud Storage and BigQuery. The security and compliance team establishes the following operational and governance requirements: The organization must retain control over the encryption key lifecycle, including defining automatic rotation schedules and immediately revoking key access to make data unreadable. The operations team wants to avoid managing dedicated on-premises hardware security modules (HSMs) or passing raw cryptographic keys with every API request. Cryptographic keys must be generated, stored, and managed natively within Google Cloud. Which encryption key management strategy should the organization implement?

Customer-Managed Encryption Keys (CMEK): ### **What Customer-Managed Encryption Keys (CMEK) are:** **Customer-Managed Encryption Keys (CMEK)** allow organizations to manage their own cryptographic keys inside Google Cloud using **Cloud Key Management Service (Cloud KMS)** or Cloud HSM. With CMEK, the customer creates and controls the root key (Key Encryption Key or KEK) used to protect the data encryption keys (DEKs) generated by Google Cloud services like BigQuery and Cloud Storage. ### **How it meets all requirements:** - **Lifecycle control and rotation (✓):** Cloud KMS allows administrators to configure automated key rotation schedules (such as every 90 days) and generate new key versions without manually re-encrypting existing data. - **Immediate access revocation (✓):** Administrators can disable or destroy a key version directly in Cloud KMS. Disabling the key immediately revokes access, rendering protected data inaccessible to all services and users. - **No on-premises infrastructure or per-request key transmission (✓):** Keys reside securely within Google Cloud KMS, removing the operational burden of managing physical on-premises HSMs or passing raw key strings in API headers. - **Native Google Cloud integration (✓):** Cloud KMS seamlessly integrates with services like BigQuery, Cloud Storage, Dataproc, and Compute Engine through service account IAM permissions. ### **Key advantages and capabilities:** - **Granular IAM permissions:** Control who can administer, encrypt, and decrypt using specific Cloud KMS keys. - **Comprehensive audit logging:** Every key access, encryption, and decryption action is logged in **Cloud Audit Logs**. - **Automated key lifecycle policies:** Define destruction delays, scheduled rotation intervals, and primary key version transitions. - **Separation of duties:** Distinct roles can be assigned to security administrators (key managers) and data practitioners (data users). ### **Why this is optimal:** CMEK provides the ideal balance between security compliance and operational efficiency. Unlike GMEK, it provides full customer control over key lifecycles and revocation. Unlike CSEK, it eliminates the operational risk of key loss and the complexity of supplying raw cryptographic keys with every API request.