HYOK, BYOK, and EKMS - What are they, and why should you use them?

[Jon Williams]

As organizations move sensitive workflows and regulated data into cloud platforms like ServiceNow, encryption key management becomes a critical part of protecting information and meeting compliance requirements. Cryptographic models like Hold Your Own Key (HYOK), Bring Your Own Key (BYOK), and External Key Management Service (EKMS) each offer a different level of control over where keys are stored, who can access them, and how encryption operations are performed. Understanding the differences between these models helps organizations balance security, operational complexity, compliance needs, and cloud usability. This document explains how each approach works and when one model may be more appropriate than another.

Bring Your Own Key - BYOK

ServiceNow Bring Your Own Key (BYOK) BYOK (Bring Your Own Key) for encryption is a security feature that lets your organization create, import, and control your own master cryptographic keys to protect data stored on the platform. BYOK is currently available for both Cloud Encryption and Field Encryption Enterprise.

How BYOK Works

• Key Generation: You generate an encryption key (such as an AES-256 key) inside your own secure environment or hardware security module (HSM).
• Secure Transfer: You use an asymmetric wrapper (like an RSA public key provided by ServiceNow) to securely wrap and import your key into the ServiceNow Cloud Encryption framework.
• Platform Operations: ServiceNow manages the actual data encryption and decryption operations using your imported key, but you retain ultimate authority over it.

Benefits of BYOK

• Data Control: You can revoke, rotate, or suspend your keys at any time. If you revoke a key, ServiceNow can no longer decrypt the associated data.
• Compliance: It helps your company meet strict internal security mandates and external regulatory requirements for data privacy.
• Segregation: It separates key management responsibilities from everyday cloud administration.

External Key Management Service (EKMS)

External Key Management Service in ServiceNow lets you keep master encryption keys outside of ServiceNow in your own key management system, such as AWS KMS, giving you direct control and a data kill switch. In the Australia release we introduced support for EKMS in Field Encryption Enterprise for customers using AWS for key management with more key management services in the works.

How EKMS Works

• External Control: You hold and manage the master keys in your own external key vault instead of ServiceNow storing them.
• Key Wrapping: ServiceNow uses an internal AES-256 key to protect data, which is then wrapped and secured using your external root keys.
• Instant Revocation: You can revoke or rotate keys directly from your external system at any time to immediately block access to your data

Benefits of EKMS

• Full Data Ownership: Prevents ServiceNow from accessing or controlling the keys governing your encrypted data.
• Compliance: Aligns with strict enterprise security and regulatory rules by enforcing separation of duties.
• Operational Control: Allows automated or manual key rotation and lifecycle management straight from your own infrastructure.

Hold Your Own Key (HYOK)

Hold Your Own Key in ServiceNow refers to an advanced cryptographic security model where encryption keys are stored and managed entirely within the customer's own local or on-premises environment, completely outside the cloud provider's infrastructure.

How HYOK Works

• External Key Custody: Unlike standard Cloud Encryption or Bring Your Own Key (BYOK) where keys reside in a cloud-based Key Management Service (KMS), HYOK keeps keys strictly on-premises or in customer-controlled Hardware Security Modules (HSMs).
• Decryption Boundary: All encryption and decryption operations happen on the customer's side, ensuring plaintext data is never exposed to the cloud vendor.
• Third-Party Gateways: Because native platform shifts (such as ServiceNow moving toward internal Platform Encryption) place the encryption boundary inside the cloud, third-party edge tools like OpenText Data Privacy & Protection Sentry or StratoKey are often used to maintain an edge-based HYOK model for ServiceNow.

Benefits of HYOK

• Maximum Security: If the cloud provider's environment is compromised, the data remains unreadable because the keys are not stored there.
• Strict Compliance: Essential for defense contractors, government agencies, and highly regulated sectors dealing with ITAR, CUI, or strict national data sovereignty laws.
• Absolute Jurisdiction: Guarantees that no third party or foreign entity can access the decryption keys without direct organizational authorization

BYOK vs HYOK

Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK) are two distinct encryption key management models.

Key Differences

• Bring Your Own Key (BYOK): You generate your own cryptographic keys and import the key material into the cloud provider's key management infrastructure. ServiceNow manages the underlying hardware security modules (HSMs) and executes cryptographic operations, but you retain control over key rotation, lifecycles, and deletion policies.
• Hold Your Own Key (HYOK): You keep the encryption keys entirely within your own local infrastructure or a separate external key manager outside of ServiceNow's environment. ServiceNow must call your external service for any authorized decryption or encryption operation, meaning the cloud provider never stores or has direct access to the raw key material.

Comparison Summary

Feature	Key Storage	Cryptographic Operations	Control & Sovereignty	Complexity & Overhead
BYOK	Imported into ServiceNow's cloud/KMS infrastructure	Executed inside the provider's boundary using your key	Moderate-to-high; protects against default provider keys, but the provider handles runtime usage	Low-to-moderate; integrates easily into standard cloud workflows
HYOK	Kept on-premises or in customer-controlled external systems	Executed strictly in your own environment or external KMS	Maximum; prevents provider access entirely, fulfilling strict data residency mandates	High; requires dedicated on-premises HSM infrastructure, high availability, and network redundancy

EKMS vs HYOK

Within ServiceNow EKMS is a sub-category of HYOK. The primary difference lies in the location of the keys: with true HYOK, your organization retains absolute ownership by hosting and managing encryption keys completely outside of ServiceNow's infrastructure. ServiceNow’s EKMS is the specialized plugin and service framework that allows you to achieve this HYOK model by integrating ServiceNow with an external key manager (such as AWS KMS).

In summary, HYOK, BYOK, and EKMS each provide a different balance of encryption control, operational complexity, and compliance assurance for organizations using ServiceNow. BYOK offers a practical way to retain key ownership while preserving cloud usability, HYOK delivers the strongest separation of key custody, and EKMS provides a framework for integrating external key control into the platform. The right choice depends on your organization’s regulatory obligations, risk tolerance, infrastructure maturity, and need for data sovereignty. As a next step, assess your most sensitive ServiceNow data flows and map them to the key management model that best supports your security, compliance, and business requirements.

Keep up with the Platform Security team and get the most up to date information by following us on the ServiceNow Community and check out our new Platform Encryption Learning Path!