---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Encrypting fields and attachments

# Encrypting fields and attachments {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

After you create your cryptographic modules, create encrypted field configurations and
specify whether to encrypt a field on a table or encrypt attachments.

## How to encrypt fields {#field-encryption-key-management__section_rmd_zv4_tnb}

Note:  
Encrypted fields are not audited by design. This behavior is not configurable.  
1. Specify the key source: system-generated keys or your customer supplied keys (bring your own key) in System SecurityField Encryption Settings.
2. After you specify the key source, create a new cryptographic module or use an existing cryptographic module. Start with [Create a cryptographic module](https://www.servicenow.com/docs/_B5LQoO30fa~baK20wx4ig "Create a cryptographic module to define the mechanisms used for cryptographic operations. After you create the module, you create a cryptographic specification, where you define an algorithm for encryption and generates a key.") for instructions.  
   Note:  
   If you use customer-supplied keys, follow the directions in [Create cryptographic module for Field Encryption](https://www.servicenow.com/docs/iWpnIVjpLCG5kUySh2KHfg "Create a Column Level Encryption cryptographic module to define the mechanisms used for cryptographic operations.") and [Configure properties for customer-supplied keys](https://www.servicenow.com/docs/Lef5MyrmLteZNbtAeXuC6Q "If the Column Level Encryption Enterprise plugin is enabled, you can use system properties to define key padding, ephemeral key pair size, and a key validity period of your customer-supplied keys.").
3. Create an encrypted field configuration, which is where you specify the table on which the encryption is performed and either the column in the table or the attachments in the table to encrypt. See [Set encrypted field configurations](https://www.servicenow.com/docs/hM7G2LqDimpZcEb8wc6LaA "Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.") to get started.

{#field-encryption-key-management__ol_lct_1w4_tnb}  
Note:  
See [Field Encryption Enterprise examples](https://www.servicenow.com/docs/20fnJQLHJFn93Dp2Y6EKYQ#kmf-walkthroughs-tutorials "These examples walk you through the encryption of fields and attachments using customer-supplied keys.") that illustrates how to encrypt fields and attachments using customer-supplied keys.
* **[Set encrypted field configurations](https://www.servicenow.com/docs/hM7G2LqDimpZcEb8wc6LaA)**   
  Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.
* **[Script access for cryptographic modules](https://www.servicenow.com/docs/EQ95LKJp0KNFeVuhNgGeIg)**   
  Scripts can be run to access a cryptographic module policy for a cryptographic purpose.
* **[Schedule mass encryption, decryption, and rekeying jobs](https://www.servicenow.com/docs/4fAlydMoNrm2nymCS47IfA)**   
  Schedule encryption, decryption, and rekeying jobs to run at a time that is best for your instance.
* **[Run mass encryption or decryption](https://www.servicenow.com/docs/HQrNPIXOz0H_Gw_PHQk~xg)**   
  You can run mass encryption on encryption configurations, as well as a mass decryption to decrypt previously encrypted values.

*[\>]: and then