Encryption is the foundation of cloud security. But who controls the keys? By default, the cloud provider does. This is convenient, but often not sufficient for sensitive government or regulated data — because whoever controls the key can decrypt the data, and that includes the provider itself and potentially foreign authorities. This article is the practical companion to our guide on digital sovereignty for the public sector and compares the two models that put key control back in your hands.
Whoever Holds the Key, Holds the Power
The solution: take control of your keys yourself. The two most important models for this are Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK), also known as external key management.
Bring Your Own Key (BYOK)
The principle: You create your keys in your own environment (e.g., with an on-premises Hardware Security Module – HSM) and securely import them into the cloud provider’s key management system (e.g., Azure Key Vault, GCP Cloud KMS).
Advantages:
- Full control over the creation and lifecycle of the key.
- The key can be revoked (deleted) at any time, rendering the data unusable.
- Relatively simple integration with most cloud services.
Disadvantages:
- The key is physically located in the provider’s cloud. Access by the provider, though unlikely, is not 100% technically impossible.
Provider services: Azure Key Vault (Premium tier), GCP Cloud KMS with imported keys, AWS KMS with imported key material.
Hold Your Own Key (HYOK) / External Key Management
The principle: The key never leaves your own controlled environment. The cloud services send the data to be encrypted or decrypted to your external key manager. The key itself is never transferred.
Advantages:
- Maximum control and sovereignty. The key is physically and logically separate from the cloud.
- Access by the cloud provider or third parties is technically impossible without your key manager.
Disadvantages:
- Higher complexity and potentially higher latency.
- Requires a highly available key management infrastructure of your own.
- Not supported by all cloud services.
Provider services: Azure Key Vault Managed HSM, GCP External Key Manager (EKM), AWS KMS External Key Store (XKS).
Quick Checklist: Which Model is Right?
| Criterion | BYOK | HYOK/EKM |
| Sovereignty Level | High | Very High |
| Complexity | Medium | High |
| Performance | High | Medium |
| Cost | Medium | High |
| Service Compatibility | Broad | Limited |
| Recommendation for | Standard for sensitive data | Highest protection needs (KRITIS, classified information) |
To-Do List for Sovereign Key Management
- Week 1: Analyse the protection needs of the data requiring key control.
- Week 2: Evaluate the BYOK and HYOK offerings of the cloud providers in detail.
- Month 1: Decide on a model (or a combination).
- Month 2: Create a concept for the on-premises HSM infrastructure (if necessary).
- Month 3: Configure the key management service in the cloud.
- Month 4: Define processes for key lifecycle management (creation, rotation, deletion, emergency access).
Integration into the Security Architecture
External key management is not an isolated topic. It must be integrated into the overall BSI-compliant cloud security concept. It is a central measure for meeting the requirements of BSI C5, IT Baseline Protection, NIS2 and GDPR.
The processes surrounding key management must be clearly defined and documented. Who can create keys? Who approves their use? What happens in an emergency? IT Baseline Protection consulting helps to design these processes robustly.
Insight42: Cloud Key Management Expertise
We help you regain control over your keys and thus your data. We analyse your needs, compare the solutions, and implement the model that is right for you — whether it’s BYOK with Azure Key Vault or HYOK with external HSMs.
Lock your data securely. See Verschlüsselung & Key Management (German) or contact us.