An enterprise is establishing a data governance and encryption framework on Google Cloud to comply with strict regional data sovereignty and regulatory standards. The compliance baseline dictates the following technical requirements: All regional service data must be encrypted using Customer-Managed Encryption Keys (CMEK) protected by hardware security modules (Cloud HSM). Key management must enforce strict separation of duties between key custodians and application resource administrators. Key rotation must occur periodically such that newly written data uses the latest cryptographic key version while existing historical data remains continuously decryptable without data loss. Which Cloud KMS configuration and lifecycle management strategy should the security architect specify?

Provision Cloud HSM-backed CMEK keys in a dedicated key management project in the same region as the data services, rotate keys by generating a new primary key version, and maintain older key versions in an enabled state.: What Cloud HSM-Backed CMEK and Project Isolation Provide Customer-Managed Encryption Keys (CMEK) hosted in Cloud Key Management Service (Cloud KMS) with the Cloud HSM protection level provide hardware-rooted FIPS 140-2 Level 3 cryptographic security. By creating key rings in a dedicated key management project, organizations enforce a strict separation of duties between KMS Administrators (who manage key lifecycles and IAM policies on keys) and Service Project Administrators (who manage storage and database resources). How It Meets the Requirements Regulatory sovereignty and location alignment: Regional data resources require CMEK keys residing in the exact same geographic region to adhere to data residency and operational latency policies. Separation of duties: Isolating Cloud KMS key rings in a centralized security project prevents unauthorized resource operators from modifying key states, rotation schedules, or access controls. Continuous access during key rotation: When a symmetric encryption key is rotated in Cloud KMS, a new key version is generated and set as the primary version for future encryption operations. Retaining earlier key versions in an enabled state ensures that historical data encrypted with those versions remains readable without requiring immediate, high-overhead data re-encryption. Key Advantages Envelope encryption control: Allows granular audit logging via Cloud Audit Logs for every cryptographic encrypt and decrypt call. Zero-downtime key rotation: Ingestion pipelines automatically utilize the new primary key version while read paths continue decrypting historical objects seamlessly. Compliance alignment: Fulfills regulatory mandates demanding hardware-backed cryptographic boundaries and least-privilege administrative zoning. Why This Is Optimal This architecture establishes a robust governance model where key access, location constraints, and cryptographic lifecycles are centralized and secured without disrupting ongoing storage read and write operations.