---
sourceDocument: Xanadu Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/xanadu/platform-security

 Release :

    - xanadu

ft:locale :

    - en-US

ft:publication_title :

    - Xanadu Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Column Level Encryption Enterprise

# Column Level Encryption Enterprise {#ariaid-title1}

* Release version: Xanadu
* 
* Updated August 1, 2024
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 5 minutes to read

Column Level Encryption Enterprise utilizes the Key Management Framework (KMF) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to utilize Column Level Encryption Enterprise.  
Important:  
Column Level Encryption (CLE) and Column Level Encryption Enterprise (CLEE) have begun their end-of-life process and reached the end-of-sale and renewal milestones as of the Australia release. It will no longer be supported as of December 2028.
For field encryption support see or [Column Level Encryption Enterprise](https://www.servicenow.com/docs/XGaiq3tIggqo020RXwYIXA "Column Level Encryption Enterprise utilizes the Key Management Framework (KMF) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to utilize Column Level Encryption Enterprise.") for premium field and attachment encryption support.
Column Level Encryption Enterprise is premised with Column Level Encryption and uses the Key Management Framework and its full support of key management functions. Column Level Encryption Enterprise provides key-protection and key life-cycle management for application-level field encryption. All keys are protected with a key-wrapping hierarchy ultimately rooted in FIPS
140-2-L3 Hardware Security Modules (HSM).  
Important:  
This topic covers the enterprise version of Column Level Encryption. For information on the standard version of Column Level Encryption, or to learn the differences between the two versions, see [Exploring Column Level Encryption](https://www.servicenow.com/docs/EGT1dAtOTypBrqgRi3CPLw "Learn more about Column Level Encryption.").

Column Level Encryption Enterprise gives you the ability to manage how supported fields are encrypted and decrypted in accordance with [NIST 800-57](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf) practices. It also uses the most updated version of field-level encryption, including integration for proper key protection and management.

Specifically, Column Level Encryption Enterprise utilizes the KMF encryption modules, granting you more control of server-side encryption. KMF ensures proper data encryption key protection using key hierarchy and envelope encryption. Your instance encrypts data through cryptographic modules that you configure. You can
create an access policy for each module then configure cryptographic specifications and access policies and control key life-cycle management control.

Column Level Encryption Enterprise supports module access policies based on:  
* Scope
* Role
* Script
* Resource Exchange
* System User
{#now-platform-encryption__ul_krq_r1q_3pb}
See [Create a module access policy](https://www.servicenow.com/docs/TLgW1ph7I9G8pGSRDbEj5A "Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.") for additional information.  
Note:  
For details on the supported features of Column Level Encryption and how to upgrade and subscribe to the Column Level Encryption Enterprise entitlement refer to [Encryption and Key Management subscription bundle](https://www.servicenow.com/docs/V7zCHaQTlzE~68z50gDY6g "With Key Management, Column Level Encryption is upgraded at no additional charge to include highly configurable encryption modules. You can also optionally upgrade to the unlimited-use license. Subscribe to the new encryption entitlement bundle, Platform Encryption, which includes Column Level Encryption Enterprise and Cloud Encryption.").

## Encryption terms {#now-platform-encryption__section_k54_ngb_54b}

{#now-platform-encryption__table_ddr_sgb_54b__entry__2}

| Term | Description |
|-|-|
| Figure 1. Key management | Support for key management Fundamental to Column Level Encryption Enterprise is the Key Management Framework (KMF). Gain the following capabilities: * Key life-cycle management. * Key rotation. See [Rotate keys](https://www.servicenow.com/docs/5eFX8sgKHVW8_rJpWthb_A "For increased security, you can rotate your cryptographic keys on a pre-determined schedule. Key rotation is when you retire an encryption key and replace that old key by generating a new cryptographic key.") for details. * Key protection and key generation with FIPS 140-2-L3 Hardware Security Modules (HSMs). * Segregation of roles and duties. * The secure transfer of data encryption keys between instances, such as production and non-production instances. * Customer Supplied Keys (CSK) with key-wrapping. * Non-deterministic encryption. * Mass encryption/decryption. * Auditing of key access/use. {#now-platform-encryption__ul_rmp_4hb_54b} See [Key Management Framework Reference](https://www.servicenow.com/docs/G6ffAtTu3IMPrcXDOTcH7g "The Key Management Framework (KMF) API/UX lets you fully customize and manage how cryptographic operations are performed on your ServiceNow instance. The ServiceNow Key Management Framework provides a secure and comprehensive interface for instance-side cryptographic key management services.") for details. |
| Figure 2. Customer-supplied key | Support for customer supplied keys One of the biggest benefits of Column Level Encryption Enterprise is that you can use your own keys for encryption. Administrators have the choice to use ServiceNow supplied keys or your own customer-supplied keys (CSK) for encryption on the ServiceNow AI Platform®. You can also manage the key life cycle and decide when to revoke, rotate, and inactivate the keys. After you enable customer-supplied keys and create a cryptographic module, you download a token and public ephemeral key. You use the token and public key to wrap your key and then upload to the instance. To use customer-supplied keys, see [Configure field encryption settings to select key type](https://www.servicenow.com/docs/Oj3GdjNfBdasVv1lnh3fqQ "Configure your field encryption settings to use ServiceNow supplied keys or your own customer-supplied keys (CSK) for encryption on the ServiceNow AI Platform.") and [Using customer supplied keys with Column Level Encryption Enterprise](https://www.servicenow.com/docs/F0a2rXij6MLv8tTT7EMUfw "You can use your own customer-supplied key instead of using the ServiceNow system-generated keys.") . |
| Figure 3. Column Level Encryption | Support for both field encryption and attachment encryption Both field encryption and attachment encryption utilize cryptographic modules and access policies through Encrypted Field Configurations. The Encrypted Field Configuration form is used to choose an encryption type of column or attachment encryption. See [Set encrypted field configurations](https://www.servicenow.com/docs/Qb1PP2nchHw7BNkmmRCajA "Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.") for more information and supported field types. |
| Figure 4. Non-deterministic encryption | Support for non-deterministic encryption Column Level Encryption Enterprise supports non-deterministic encryption for enhanced security. If the system encrypts the same data more than once, the ciphertexts are different each time. Non-deterministic encryption is available with AES encryption with Cipher Block Chaining (CBC). You can enable this feature through the Equality Preserving option on the Algorithm Definition stage of the cryptographic specification. Create a cryptographic specification for a crypto module and define an algorithm for encryption and generate the key. See [Create a cryptographic module](https://www.servicenow.com/docs/e7uHtVZdOrcU_PA0G4aFtg "Create a cryptographic module to define the mechanisms used for cryptographic operations. After you create the module, you create a cryptographic specification, where you define an algorithm for encryption and generates a key.") to define the mechanisms used for cryptographic operations and for more information on enabling non-deterministic encryption. |
| Figure 5. Resource Exchange | Resource Exchange Column Level Encryption Enterprise keys instance to instance in a secure manner using the KMF cryptographic APIs to provide confidentiality, integrity, authentication, and non-repudiation. Resource Exchange is a KMF feature that gives you the capability to exchange resources between instances in a secure manner. See [Key Management Framework Resource Exchange](https://www.servicenow.com/docs/h~jDnqIBdyh7t~A0XQ_PCg "ServiceNow Resource Exchange is a KMF feature that gives you the capability to exchange resources between instances in a secure manner.") for details. |
[ ]

{#now-platform-encryption__table_ddr_sgb_54b} Note:  
If you choose not to activate Column Level Encryption Enterprise, you can still use Column Level Encryption. See [Exploring Column Level Encryption](https://www.servicenow.com/docs/EGT1dAtOTypBrqgRi3CPLw "Learn more about Column Level Encryption.") for information.

Column Level Encryption Enterprise supports on-premise customers. It doesn't support Domain Separation.

## Support for additional modules and module access policies {#now-platform-encryption__section_lty_nbs_dwb}

The standard version of Column Level Encryption is limited to five modules and module access policies (MAP). Column Level Encryption Enterprise supports a larger number of modules and MAPs.

## Supported field information {#now-platform-encryption__section_vd3_zjn_wlb}

The following field types can be encrypted:

* Attachments
* Date
* Date/Time
* Email
* HTML
* Journal
* Journal Input
* Journal List
* Phone
* String text
* Translated Field
* Translated HTML
* Translated Text
* URL
{#now-platform-encryption__ul_nn2_xnn_wlb}

## Attachment Encryption {#now-platform-encryption__section_znm_vn3_myb}

Attachment encryption by default

:   Customers using Column Level Encryption have attachments encrypted by default in tables that have an active Encrypted Field Configuration (EFC) type of Attachment.

    This default encryption defined by the EFC configuration means that admins don't need to manually declare that an attachment should be encrypted on upload for these tables.

Administrators can disallow users from attaching unencrypted files
:   For details, see [Prevent users from attaching unencrypted files](https://www.servicenow.com/docs/QqMrq3D3wC_AYxEOAt48dA "Modify the com.glide.encryption.enable_attachment_key_ui property to prevent your users with access to an encryption module key from attaching unencrypted attachments.").

Opt out of default encryption

:   If you don't want attachments encrypted by default based on EFC configuration, you can opt out of this option by contacting ServiceNow support.

    To opt out of this feature, create a support case with ServiceNow support, and include this statement in a comment on the case record:
    `"I [customer name], understand that I am asking `ServiceNow` to turn off a recommended security best practice for attachments, and that [customer company] assumes any additional risk related to their configuration and use of unencrypted
    attachments in the `ServiceNow` application."`

## API support {#now-platform-encryption__section_vzm_vxk_znb}

Column Level Encryption Enterprise updates the `setDisplayValue()` and `setValue()` APIs so they can insert encrypted data for encrypted fields. It also enables
`getDisplayValue()` and `getValue()` to return cleartext values.

The following script illustrates these API changes when the Incident short description is
encrypted:  


    var gr = new GlideRecord('incident'); //creates a new incident
    gr.setValue('short_description','test123'); //sets the value to test123
    var sys_ID = gr.insert(); //inserts the record in the Incident table.
    gs.info(gr.getValue('short_description')); //displays the unencrypted value

When using `getValue()` to get encrypted text, your script no longer returns the ciphertext. Your script returns the plaintext, assuming that the user has access to the cryptographic module.
`getValue()` returns the ciphertext for users who don't have access to the cryptographic module.