Combined Encryption Key Management release notes for upgrades from Yokohama to Zurich

zurich Combined Product Files

Release

zurich

ft:locale

en-US

ft:publication_title

zurich Combined Product Files

ft:clusterId

delta3zy

bundleId

delta3zy

Combined Encryption Key Management release notes for upgrades from Yokohama to Zurich

Release version: Zurich

Updated August 11, 2026

5 minutes to read

Summarize

Summarized using AI

Summary of Combined Encryption Key Management Release Notes for Upgrades from Yokohama to Zurich

This document consolidates all key release notes related to Encryption Key Management when upgrading ServiceNow instances from the Yokohama release to the Zurich release. It highlights important changes, new features, deprecations, and upgrade considerations to help customers prepare and execute a smooth upgrade.

Show full answer Show less

Important Upgrade Information

Both Yokohama and Zurich releases address the deprecation of the GlideEncrypter API's use of the three-key Triple Data Encryption Standard (3DES) encryption, which is no longer recommended by NIST after 2023. Key points include:

New instances on Yokohama and Zurich releases cannot use GlideEncrypter with 3DES.
Existing Yokohama instances can continue 3DES usage but can disable it via a system property.
Zurich upgrades update GlideEncrypter to use AES256-GCM encryption through the Key Management Framework, enhancing security.
Disabling GlideEncrypter on upgraded Zurich instances requires administrative privileges and is controlled by the glide.security.glideencrypter.allow system property.

New Features

Field Encryption Rebranding: Column Level Encryption has been renamed to Field Encryption Starter (FES), and Column Level Encryption Enterprise is now Field Encryption Enterprise (FEE).
Access Observer: Introduced to monitor and analyze who accesses data on the instance, aiding in security and compliance.
Improved Migration Workflow: A streamlined process for migrating from Edge Encryption to Field Encryption ensures data remains encrypted during migration without downtime.
Audit Logging Enhancements (Zurich): Changes to Field Encryption and Key Management configurations are now logged by default in the Sys Audits [sysaudit] table, allowing better tracking and compliance auditing.

Changes

GlideEncrypter API now defaults to AES256-GCM encryption via the Key Management Framework in Zurich upgrades.
Administrators can enable or disable GlideEncrypter usage through a system property on upgraded instances; this property is unavailable on new Zurich instances.

Deprecations and Removals

No features or functionalities related to Encryption Key Management were removed or deprecated between Yokohama and Zurich releases beyond the GlideEncrypter/3DES phase-out described above.

Activation and Licensing

The Platform Encryption subscription bundle includes Field Encryption Enterprise and Cloud Encryption. Activating Field Encryption Enterprise requires enabling the com.glide.now.platform.encryption plugin. This licensing and activation approach remains consistent from Yokohama through Zurich.

Additional Notes

No changes to browser requirements, accessibility, or localization were introduced between Yokohama and Zurich.
Important to review the Sys Audits [sysaudit] table in Zurich for better visibility into encryption-related changes.

Practical Implications for ServiceNow Customers

When upgrading to Zurich, customers should plan to transition away from 3DES encryption due to security best practices and regulatory recommendations. The upgrade provides enhanced encryption standards (AES256-GCM) integrated with the Key Management Framework, improving data security. Customers can leverage new tools like Access Observer to monitor data access and use improved migration processes to maintain encryption integrity during transitions.

Administrators should familiarize themselves with the new system property controlling GlideEncrypter usage to manage legacy encryption scenarios. Additionally, auditing improvements enable better compliance tracking for encryption configurations.

Consolidated page of all release notes for Encryption Key Management from Yokohama to Zurich.

How to use this page

To help you prepare for your upgrade, we have combined the cross-family Encryption Key Management release notes onto one page. Read this summary of the new features, changes, and updated information for your product from Yokohama to Zurich.

Tip:

If there were no updates for a release notes section in a certain family release, we included a short note for your reference. For example, if a product did not have any updates in Tokyo, the row says "No updates for this release."

Important information for upgrading Encryption Key Management to Zurich

Before you upgrade to Zurich, review these pre- and post-upgrade tasks and complete the tasks as needed.


Release	Release notes
Yokohama	The GlideEncrypter API uses the three-key Triple Data Encryption Standard (3DES) encryption standard which NIST 800-131A Rev 2 has recommended against using after 2023. The following changes are taking place in the Yokohama release in preparation for a full deprecation of GlideEncrypter/3DES in the future. New Yokohama instances can’t use GlideEncrypter. All base system scripts have been changed to use alternative encryption processes. if you’re upgrading your Yokohama instances, you can still use 3DES, but you can also disable 3DES usage with a system property. Learn more about 3DES deprecation in KB1704481.
Zurich	In previous releases, the GlideEncrypter API used the three-key Triple Data Encryption Standard (3DES) encryption standard, which NIST 800-131A Rev 2 has recommended against using after 2023. The following changes are taking place in the Zurich release in preparation for a full deprecation of GlideEncrypter/3DES in the future: New Zurich instances can’t use GlideEncrypter. All base system scripts have been changed to use alternative encryption processes. if you’re upgrading your Zurich instances, you can still GlideEncrypter, which has been updated to use AES256-GCM encryption via the Key Management Framework. Learn more about 3DES deprecation in KB1704481.

New features

Between your current release family and Zurich, new features were introduced for Encryption Key Management.


Release	Release notes
Yokohama	Column Level Encryption is now Field Encryption Column Level Encryption has been rebranded to Field Encryption Starter (FES), while Column Level Encryption Enterprise is now Field Encryption Enterprise (FEE). Access observer Use access observer to understand the people and processes that access data on your instance. Improved migration process from Edge Encryption to Field Encryption Use the new process for migration from Edge Encryption to Field Encryption (formerly Column Level Encryption). This improved workflow ensures that your data migrates from Edge Encryption to Field encryption without spending time in an unencrypted state.
Zurich	Keep track of Field Encryption and Key Management changes By default, the changes to the records on these tables are now logged to the Sys Audits [sys_audit] table: Encrypted Field Configurations [sys_platform_encryption_configuration] Module Access Policies [sys_kmf_crypto_caller_policy] Cryptographic Modules [sys_kmf_crypto_module] For details on accessing the Sys Audits [sys_audit] table, see Review.

Changes

Between your current release family and Zurich, some changes were made to existing Encryption Key Management features.


Release	Release notes
Yokohama	No updates for this release.
Zurich	Updates to GlideEncrypter functionality The GlideEncrypter API has been updated to use AES256-GCM encryption via the Key Management Framework. If needed, your instance can be changed to use legacy 3DES encryption, but this task can only be done by ServiceNow support. Disable GlideEncrypter on your instance GlideEncrypter can be enabled or turned off using the glide.security.glideencrypter.allow system property. This property is unavailable on new Zurich instances, but administrators with the security_admin role can edit this property in upgraded instances. When this system property is set to false, users see this error when attempting to run GlideEncrypter. `Unsupported call to GlideEncrypter. Details: GlideEncrypter is deprecated and now returns null, please refer KB1320986`

Removed

Between your current release family and Zurich, some Encryption Key Management features or functionality were removed.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Deprecations

Between your current release family and Zurich, some Encryption Key Management features or functionality were deprecated.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Activation information

Review information on how to activate Encryption Key Management.


Release	Release notes
Yokohama	The Platform Encryption subscription bundle is a group commercial entitlement that includes Field Encryption Enterprise and Cloud Encryption. Field Encryption Enterprise is the unlimited license of Field Encryption. The Enterprise plugin is available with the activation of the com.glide.now.platform.encryption plugin. For details, see Encryption and Key Management subscription bundle.
Zurich	The Platform Encryption subscription bundle is a group commercial entitlement that includes Field Encryption Enterprise and Cloud Encryption. Field Encryption Enterprise is the unlimited license of Field Encryption. The Enterprise plugin is available with the activation of the com.glide.now.platform.encryption plugin. For details, see Encryption and Key Management subscription bundle.

Additional requirements

If any additional requirements were introduced or changed for Encryption Key Management we have noted them here.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Browser requirements

If any specific browser requirements were introduced or changed for Encryption Key Management we have noted them here.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Accessibility information

Review details on accessibility information for Encryption Key Management, such as specific requirements or compliance levels.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Localization information

If there are specific localization considerations for Encryption Key Management we have noted them here.


Release	Release notes
Yokohama	No updates for this release.
Zurich	No updates for this release.

Highlight information

If there are specific highlight considerations for Encryption Key Management we have noted them here.


Release	Release notes
Yokohama	Column Level Encryption has been rebranded and redesigned to now be called Field Encryption. Use Access Observer to help plan for and troubleshoot Field Encryption implementations. Edge Encryption administrators can use the new process to migrate from Edge Encryption to Field Encryption. See Key Management Framework for more information.
Zurich	See the changes to the Key Management and Field Encryption records that are now logged on the Sys Audits [sys_audit] table. The GlideEncrypter API has been updated and now uses AES256-GCM encryption via the Key Management Framework. Enable or disable GlideEncrypter by using the glide.security.glideencrypter.allow system property. See Key Management Framework for more information.