A financial services organization is designing a data storage architecture on Google Cloud. The company's compliance policy mandates that the security team must maintain direct administrative control over encryption key lifecycles—including key creation, rotation schedules, and immediate key revocation—directly through Google Cloud's centralized key management service, while allowing cloud storage services to automatically handle encryption and decryption operations. Which encryption key management strategy should the organization implement?

Customer-managed encryption keys (CMEK): ### **What Customer-managed encryption keys (CMEK) are:** **Customer-managed encryption keys (CMEK)** allow organizations to control and manage the symmetric encryption keys used to protect data at rest within supported Google Cloud services. The cryptographic keys reside in and are managed through **Cloud Key Management Service (Cloud KMS)** or **Cloud HSM**, giving the customer control over administrative operations while allowing the target Google Cloud service to use the keys via service accounts. ### **How it meets the requirements:** - **Administrative key lifecycle control (✓):** With CMEK, administrators can generate keys, set automatic rotation schedules, create new key versions, and destroy or disable keys on demand in Cloud KMS. - **Immediate access revocation (✓):** Disabling or destroying a key in Cloud KMS immediately prevents any service or user from decrypting the associated data. - **Seamless integration with cloud services (✓):** CMEK allows integrated services (such as Cloud Storage, BigQuery, and Secret Manager) to perform server-side encryption and decryption transparently using assigned service account permissions. ### **Key advantages and capabilities:** - **Granular access management:** Access to cryptographic keys is separated from access to the data itself using **Identity and Access Management (IAM)** roles. - **Comprehensive audit logging:** Every key access, encryption, decryption, or administrative action is logged to **Cloud Logging** for audit compliance. - **Hardware-backed security options:** Keys can be protected by FIPS 140-2 Level 3 validated **Cloud HSM** instances. - **Centralized management:** Organizations can manage encryption keys across multiple services from a single Cloud KMS interface. ### **Why this is optimal:** CMEK provides the perfect balance between regulatory compliance and operational simplicity. Unlike Google-managed keys, the customer maintains complete authority over key lifecycle and revocation. Unlike client-side or customer-supplied keys, CMEK integrates natively with GCP services without requiring developers to manage key material during every API request or handle encryption client-side.