Key takeaway
Review the provider’s encryption and key model, test how client-side encryption affects workflows and document how recovery keys are protected.
Encryption in the cloud
A cloud service can encrypt files, disks, databases and data in transit. Protection at rest and in transit needs to account for when data is exposed to a user, administrator or application. Encryption reduces the risk of unauthorized reading but does not correct bad permissions or a compromised account.
Cloud and traditional encryption
For a local server or USB drive, the organization may control the encryption software and keys. In the cloud, the provider supplies a mechanism while the customer remains responsible for data classification, user access, application configuration and sometimes keys. The boundary varies by service; review its shared-responsibility and key documentation. Cryptographic algorithms can be the same locally and in the cloud; responsibility and trust boundaries differ.
Public, private and hybrid environments
In a public cloud, account for shared infrastructure and service-specific access boundaries. A private cloud may give an organization more control over internal policy, administrators and storage. In a hybrid environment, align identity, encryption and key rules as data moves between local systems and cloud services. A private cloud is not automatically safe; check configuration and effective permissions.
Provider and customer keys
For server-side encryption with provider-managed keys, document service access to plaintext, rotation and audit. Customer-managed server-side keys may give more control over policy and lifecycle, but the service can still decrypt data. Excluding provider access through client-side encryption requires keys and plaintext to remain outside provider access in that design. Key loss, disabling or deletion can affect availability; test consequences in a safe test environment. Define effects on search, collaboration, separation of duties and recovery ownership.
| Model | Who controls what | Operational test |
|---|---|---|
| Provider-managed server-side key | Provider: key lifecycle; customer: service permissions | Document service access and audit |
| Customer-managed server-side key | Customer: policy and lifecycle; service may decrypt | Test key permissions and safe recovery |
| Client-side encryption | Client key and plaintext boundary | Verify provider access, collaboration and recovery |
Controls for risk and compliance
For customer records, financial data and health information, define sensitivity, legal duties and access boundaries. Pair encryption with MFA, role-based access, safe sharing, log retention and key rotation. Map encryption and key-ownership requirements to the controls in use and retain review results. Technical test results alone do not establish legal compliance.
Check before rollout
For each service, check encryption at rest and in transit, key creation and recovery, administrator access, integrations and logs. Test data export, account closure, key rotation and service outage. Document owners, recovery authority and who decides what to do after key loss. Test key unavailability and recovery in a safe test environment without deleting a production key.