A financial enterprise is deploying a mission-critical workload on Google Cloud to handle sensitive federal financial records and payment card transaction data. The organization's compliance officer determines that the cryptographic architecture must satisfy both FedRAMP High and PCI DSS standards, specifically mandating that cryptographic keys protecting data at rest be hosted inside cryptographic modules certified to FIPS 140-2 Level 3 for physical tamper resistance. Which cryptographic key protection configuration in Google Cloud Key Management Service (Cloud KMS) should the security engineer deploy to fulfill these regulatory mandates while retaining native integration with Google Cloud services?

Create Customer-Managed Encryption Keys (CMEK) using Cloud KMS with the HSM protection level.: ### What Cloud HSM Protection Level Is **Cloud HSM** (Hardware Security Module) is a fully managed, cloud-hosted hardware security module service integrated directly into Google Cloud KMS. When keys are created with the `HSM` protection level, all cryptographic operations and key generation routines occur strictly inside dedicated hardware devices certified to **FIPS 140-2 Level 3**. ### How It Meets the Compliance Requirements - **FIPS 140-2 Level 3 validation:** Meets strict regulatory requirements where standard software cryptography is insufficient by providing physical tamper-evident mechanisms and cryptographic boundary isolation. - **FedRAMP High and PCI DSS compliance:** Fulfills mandates requiring dedicated hardware protection for root keys and Data Encryption Keys (DEKs) protecting payment card data and sensitive federal workloads. - **Native Google Cloud service integration:** Operates transparently as Customer-Managed Encryption Keys (**CMEK**) across Google Cloud services such as Cloud Storage, BigQuery, and Compute Engine without operational disruption. ### Key Advantages and Capabilities - **Hardware-enforced key boundaries:** Keys cannot be exported or extracted in plaintext from the hardware boundary. - **Global availability and scalability:** Provides seamless multi-region and dual-region redundancy backed by Google infrastructure without requiring manual HSM hardware provisioning. - **Unified IAM and auditability:** Governed by Google Cloud Identity and Access Management (**IAM**) policies and logged continuously via **Cloud Audit Logs**. - **Attestation verification:** Supports verifiable cryptographic attestation to prove to external auditors that keys were generated inside genuine FIPS-certified hardware. ### Why This Is Optimal Using Cloud KMS with the `HSM` protection level directly satisfies the stringent **FIPS 140-2 Level 3** requirements for hardware isolation while preserving the automated lifecycle, scaling, and deep service integrations of native Google Cloud CMEK workflows.