---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Exploring the Key Management Framework

# Exploring the Key Management Framework {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 Minuten Lesedauer

Learn about the components of the Key Management Framework (KMF), and how to use them to manage how cryptographic operations are performed on your instance.

## Components of the Key Management Framework {#explore-kmf__section_m3m_klw_jyb}

Key Management Framework consists of the following components.

Cryptographic modules

:   KMF is centered around managing cryptographic modules. These modules act as the parent record for the other components. They define what data on your instance is encrypted, and what method of encryption to use. Using
    multiple modules, you can encrypt different areas of your instance with different specifications.

    For example, you can create a module to secure the data in your Human Resources application to users with a specific role. You could then create another module to encrypt Incident descriptions which are visible to certain
    users based on a script you create.

    Module access policies are found by navigating to AllKey ManagementCryptographic ModulesAll. For more information on these modules, see [Cryptographic module overview](https://www.servicenow.com/docs/BEPv5XaPvXfL6bnZoCpjKg "The Key Management Framework (KMF) is centered around managing Cryptographic modules. Use these modules to select a cryptographic mechanism and define where they're applied on your instance.").

Module keys

:   Cryptographic keys are strings of characters used in cryptography. When used together with a cryptographic algorithm, they can encode or decode your data. These keys are used by the cryptographic specifications assigned to
    your modules. You can choose to use a key generated by ServiceNow, or upload your own key.

    You can access the module keys for a cryptographic module in the Module Keys related list in cryptographic module records. For more information on module keys, see [Instance level keys in the Key Management Framework](https://www.servicenow.com/docs/zjmKV9yH4IISAeQ_gNCbWA "Learn about the Key Management Framework (KMF) key structure, which uses envelope encryption to ensure that all platform keys under KMF management are protected through a chain of keys. Customer Data Encryption Keys (CDEKs) created by KMF are also included in this structure").

Cryptographic specifications

:   A cryptographic specification defines algorithms used to encrypt your data. These algorithms use a cryptographic key to encode or decode your data. Assigning a cryptographic specification to the module determines how the
    data assigned to that module is encrypted.

    You can access the module keys for a cryptographic module in the Crypto Specifications related list in cryptographic module records. For more information on module keys, see [Cryptographic specification overview](https://www.servicenow.com/docs/9DHKEp9EL2VYGfVuKxn5xQ "The Cryptographic specification is the component that defines aspects of your cryptographic module, including its cryptographic purpose and which encryption algorithm to use.").

Module access policies

:   Module access policies (MAPs) are the access controls you apply to your cryptographic modules. Use these policies to determine which users and scripts can access data encrypted by a cryptographic module.

    Find module access policies by selecting the View access policies link in cryptographic module records. For more information, see [Module access policy overview](https://www.servicenow.com/docs/Hb6QhzKPrYM5IHCV_vaOHw "Module access policies (MAPs) are access controls that you apply to your cryptographic modules. Use these access policies to decide which users and scripts can access data encrypted by a cryptographic module.").

## Key Management Framework workflow {#explore-kmf__section_n3m_klw_jyb}

1. Assign KMF roles
:   Administrators must begin by assigning themselves the sn_kmf.admin role. This role enables you to use KMF features and assign KMF roles to other users.

2. Configure KMF settings
:   Configure your field encryption settings to select either supplied keys or your own customer-supplied keys (CSK) for encryption.

3.Create cryptographic modules
:   Use cryptographic modules to select a set of data on your instance to be encrypted. In later steps, you assign a cryptographic specification to determine how to encrypt this data, and a module access policy to determine who
    can decrypt the data.

4. Create a cryptographic specification
:   The cryptographic specification defines a method of encryption. Once assigned to a module, it defines how the data assigned to that module is encrypted.

5. Create module access policies
:   After creating modules to secure your data, create module access policies to control which users and scripts are able to access the encrypted data.

6. Create a cryptographic module life-cycle policy
:   These policies place limits on cryptographic modules, such as how long a cryptographic key is valid. These policies can safeguard your cryptographic modules by limiting their exposure.

## Key Management Framework benefits {#explore-kmf__section_q3m_klw_jyb}

{#explore-kmf__table_r3m_klw_jyb__entry__3}

| Benefit | Feature | Users |
|-|-|-|
| Protect your sensitive and proprietary data. | Encryption and key Management | All |
| Maintain compliance with [NIST 800-57](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf) guidelines. These guidelines are provided by the National Institute of Standards and Technology to reduce cybersecurity risk to your networks and data. | Encryption and key Management | Security administrators |
| Use the Key Management Framework to generate, upload, view, and manage your cryptographic keys. Use key rotation for manual or scheduled rotation of your keys for increased security. | Key Management Framework | Security administrators |
[ ]

{#explore-kmf__table_r3m_klw_jyb}
* **[Cryptographic module overview](https://www.servicenow.com/docs/BEPv5XaPvXfL6bnZoCpjKg)**   
  The Key Management Framework (KMF) is centered around managing Cryptographic modules. Use these modules to select a cryptographic mechanism and define where they're applied on your instance.
* **[Cryptographic specification overview](https://www.servicenow.com/docs/9DHKEp9EL2VYGfVuKxn5xQ)**   
  The Cryptographic specification is the component that defines aspects of your cryptographic module, including its cryptographic purpose and which encryption algorithm to use.
* **[Module access policy overview](https://www.servicenow.com/docs/Hb6QhzKPrYM5IHCV_vaOHw)**   
  Module access policies (MAPs) are access controls that you apply to your cryptographic modules. Use these access policies to decide which users and scripts can access data encrypted by a cryptographic module.
* **[Instance level keys in the Key Management Framework](https://www.servicenow.com/docs/zjmKV9yH4IISAeQ_gNCbWA)**   
  Learn about the Key Management Framework (KMF) key structure, which uses envelope encryption to ensure that all platform keys under KMF management are protected through a chain of keys. Customer Data Encryption Keys (CDEKs) created by KMF are also included in this structure