--- sourceDocument: Australia Platform security sourceDocumentLink: https://www.servicenow.com/docs/r/australia/platform-security Release : - australia ft:locale : - en-US ft:publication_title : - Australia Platform security ft:clusterId : - psec bundleId : - psec workflow : - Platform --- # Exploring Column Level Encryption # Exploring Column Level Encryption {#ariaid-title1} Release version: Australia Updated June 26, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Exploring Column Level Encryption Column Level Encryption is a base system feature in ServiceNow that allows encryption of specific database fields and stored files using AES-128 or AES-256 algorithms. It uses encryption contexts where you define what data is encrypted, select the encryption algorithm, and supply encryption keys stored within your instance. Access to encrypted data is controlled by associating these contexts to user roles, enabling role-based access management. Show full answer Show less ## Key Features * **Role-Based Access:** Control encrypted data access through user roles, ensuring only authorized users can view decrypted content. * **AES Encryption:** Supports AES-128 and AES-256 encryption algorithms for robust data protection. * **Module Access Policies (MAPs):** Create up to 5 modules and MAPs to refine access control beyond roles, including considerations for system users, scripts, and the Key Management Framework (KMF) Resource Exchange. * **Field Type Support:** Encrypt common field types such as String text, Date, Date/Time, attachments, and URLs. Enterprise edition extends support to HTML, Journal, and Translated fields. * **Equality Preserving Encryption:** Enables encrypted fields to support equality comparisons and grouping operations by ensuring the same plaintext produces the same ciphertext. * **APIs for Data Access:** Use getDisplayValue() and setDisplayValue() APIs to retrieve cleartext and insert encrypted data, supporting developers and administrators in managing encrypted fields. ## Column Level Encryption Enterprise Benefits * **Extended Field and Module Support:** Encrypt additional field types and create more than 5 modules and MAPs for flexible access control. * **Automatic Key Rotation:** Configure scheduled automated rotation of keys from a key vault to enhance security and reduce administrative tasks. * **Full Key Lifecycle Management:** Manage encryption keys securely, including customer-supplied keys and secure key exchange. * **Ephemeral Keys:** Utilize cryptographic keys generated per session for enhanced security during encryption processes. * **Updated APIs:** Improved getDisplayValue() and setDisplayValue() APIs support insertion and retrieval of encrypted data efficiently. ## Cloning Considerations When an instance with Column Level Encryption is cloned, encrypted data and modules are copied, but encryption keys remain unique to the source instance. This causes encrypted fields to appear empty or unreadable on the target instance until a key exchange is performed. This behavior is expected and does not indicate data loss. ## Guidance and Next Steps The Column Level Encryption Guided Tour provides an overview and setup instructions for encrypting table fields and attachments, including the creation of Field Encryption Modules, Module Access Policies, and Encrypted Field Configurations. It also links to detailed documentation and training resources. **Important:** Using Column Level Encryption Enterprise requires a subscription and leverages the Key Management Framework (KMF) for advanced encryption management. Learn more about Field Encryption. ## Column Level Encryption overview {#exploring-column-level-encryption__section_cb1_1br_ryb} Column Level Encryption is a base system feature that permits encryption of data stored within an instance using AES128, or AES256. Column Level Encryption enables you to encrypt selected database fields and stored files through the use of encryption contexts. In these contexts you define what is encrypted, choose which algorithm to use, and supply the encryption key, which is stored within your instance. After the context is created, you can associate it to a user role. Users assigned to this role, either directly of through a group, are able to access the encrypted data. Because Column Level Encryption bases access to data on role assignment, it's important to be familiar with administering roles on your instance. For more information, see [Managing roles](https://www.servicenow.com/docs/access?context=ua-creating-roles&version=australia&pubname=australia-platform-administration&ft:locale=en-US). ## Column Level Encryption benefits {#exploring-column-level-encryption__section_gb1_1br_ryb} {#exploring-column-level-encryption__table_hb1_1br_ryb__entry__3} | Benefit | Feature | Required Roles | |-|-|-| | Configure access to your encrypted data based on assigned user roles. | Role-based access to encrypted data | security admin | | Protect your data using the Advanced Encryption Standard (AES). You can choose to use either the AES-128 or AES-256 encryption algorithms. | AES Encryption | security admin | | Create up to 5 modules and module access policies (MAP)s using the standard version of Column Level Encryption. MAPs expand on role-based access to allow considerations for: * System users * Scripts * KMF Resource Exchange {#exploring-column-level-encryption__ul_dc3_tmz_ryb}Column Level Encryption Enterprise supports additional MAPs. | Support for up to 5 modules and module access policies (MAP)s | security admin | | Encrypt common field types using the standard version of Column Level Encryption. Column Level Encryption Enterprise supports additional field types. | Encryption for String text, Date and Date/Time fields, attachments, and URLs | security admin | | Choose between standard and equality preserving encryption. When enabled, equality preserving encryption ensures that the encrypted value of a field is the same when the field value remains the same. This type of encryption enables equality comparisons and group by operations on a field. Note: Non-deterministic encryption isn't supported. | Equality preserving encryption support | security admin | | Use `getDisplayValue()` and `setDisplayValue()` APIs to return cleartext values and insert encrypted data for encrypted fields. | `getDisplayValue()` and `setDisplayValue()` APIs | security admin, developer | [ ] {#exploring-column-level-encryption__table_hb1_1br_ryb} ## Field Encryption Enterprise benefits {#exploring-column-level-encryption__section_zrl_m4z_ryb} Column Level Encryption Enterprise builds on the existing Column Level Encryption framework and provides these additional features after you purchase a subscription. {#exploring-column-level-encryption__table_nhr_54z_ryb__entry__3} | Benefit | Feature | Required Roles | |-|-|-| | Encrypt additional field types. | Support for additional field types: * HTML * Journal * Translated {#exploring-column-level-encryption__set-encrypted-field-config_ul_hhg_bcr_bsb} | security admin | | Column Level Encryption Enterprise supports more than 5 modules and module access policies to provide more options for access to secured data. | Support for additional modules and MAPs | security admin | | Keys from a key vault can be rotated on an automated schedule you configure. Using automatic key rotation can improve security while reducing administrative overhead. | Configurable automatic key rotation | security admin | | Manage the full life cycle of your data encryption keys. Optionally, you can securely exchange data encryption keys generated within your environment. | Customer supplied keys | security admin | | Ephemeral keys are cryptographic keys that are generated for each execution of a cryptographic process. These keys more secure because they're generated for use in a single session. | Ephemeral cryptographic keys | security admin | | Updated `setDisplayValue()` and `setDisplayValue()` APIs can insert encrypted data for encrypted fields. | Updated `getDisplayValue()` and `setDisplayValue()` APIs | security admin, developer | [ ] {#exploring-column-level-encryption__table_nhr_54z_ryb} ## Cloning considerations {#exploring-column-level-encryption__section_cloning_considerations} When you clone an instance that uses Column Level Encryption, the encrypted field data and encryption modules are copied to the target instance. Because encryption keys are re-encrypted with a secondary key that is unique to the source instance, the target instance can't decrypt the field data after cloning. Until a key exchange is performed, encrypted fields on the cloned instance appear empty or unreadable. This is expected behavior and does not indicate data corruption or loss. To restore access to encrypted fields on the target instance, complete a key exchange from the source instance. See [Configure Key Exchange](https://www.servicenow.com/docs/2MshxOHs38q56vEGOExSEA "Key Management Framework (KMF) generates automatic key exchange requests for supported cryptographic modules during the fresh installation or upgrade of the instance, and manages the data encryption key locally for the instance."). * **[Column Level Encryption Guided Tour](https://www.servicenow.com/docs/EgEJNRpBcXlgGWYy2xF5Cw)** The tour gives a brief overview of the Column Level Encryption setup needed to encrypt table fields or attachments. Steps for the creation of Field Encryption Modules, Module Access Policies, and Encrypted Field Configurations are also covered. The tour includes links to detailed documentation and the ServiceNow University Column Level Encryption Overview course. * **[Column Level Encryption Enterprise](https://www.servicenow.com/docs/i7gVekw7lu5uEl~UefG66w)** Column Level Encryption Enterprise uses the Key Management Framework (KMF) to enable you to customize and manage how fields and attachments are encrypted and decrypted on your instance. A subscription is required to use Column Level Encryption Enterprise.