Cloud encryption part of the servicenow Vault Suite of security products offers you complete encryption of your data we'll show you how to rotate your Cloud encryption key and switch from using a key managed by servicenow to a customer supplied key we will also show you how you can demonstrate to an auditor that you are following your organization's key rotation standard so let's get started you'll start by opening the menu and typing Cloud encryption to filter the menu then you'll click on Key Management operations to start the key rotation there you'll see a list of cloud encryption keys that have been used in the past the top one is active right now and that's the one that you want to rotate so you'll click that key Alias you are now looking at the Active key there's some basic information about when it was created and where it was sourced in this case the origin is servicenow to rotate the key you can click on either of the rotate buttons on the screen click here and then again to rotate you'll get a message here in blue telling you that a key rotation job is in progress you're still looking at the record for the previous key now the key life cycle state for this key shows rotated instead of active at the bottom of the form you have Key Management transactions these are the records of operations that have been done on this since the rotation is in progress there isn't anything here right now but if you reload the form you'll see an example of a transaction record so now you have a record here showing that this key was rotated on today's date to see information about your new active key you can click on all and go back to Key Management operations now you have a new active key and the previous key status is now listed as rotated the version of the key has also incremented from four to five and you have new time stamps to show when this key was created that's how easy it is to rotate your Cloud encryption key now you'll be shown how to rotate this key again but this time Supply your ohm encryption key instead of using one managed by servicenow since this is a key rotation you'll start the same way by clicking on the active key at the top of the key Alias list this time instead of clicking rotate key you're going to click this link to switch to customer manage key you'll be shown a message just letting you know that if you keep going you're going to have to provide your own key that's what you want so you'll click the upload manage key button since encryption keys are particularly sensitive there are some additional security steps Beyond just using TLS to encrypt data and Transit you're going to encrypt your customer supplied key before you upload it to the platform there are instructions in the product docs about downloading a wrapping certificate which can be shared after the demo after you download that you can extract a servicenow public key and use that to encrypt the cloud encryption key that you generated from your HSM or on your laptop you've already done these steps so you're just going to go ahead and click browse and pick a file to upload there you go your wrapped key file and now you can click the button to switch to customer manage key just like when you rotated the key before you're still looking at the record for the previous key you have a blue message telling you that a key rotation is in progress and if you refresh this form you'll have a key management transaction in the related section at the bottom great now let's look at the list of encryption keys and see how this new key is different there's a new active key at the top just like before but this time notice the origin it's customer supplied rather than servicenow from this page you can demonstrate to an auditor that you are rotating your keys on schedule and show whether you're using servicenow generated keys or keys that came from your own infrastructure and generated to your standards for more information see our product documentation knowledge base or podcast or ask a question in the servicenow community foreign [Music]