---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Set up Module Access Policies

# Set up Module Access Policies {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure module access policies in External Key Management Service (EKMS) to control who can view encrypted data in clear text.

## Before you begin

Role required: admin  
Confirm that you have:

* [Created a cryptographic module with external key wrapping enabled](https://www.servicenow.com/docs/_xRdF8Dnq84kyGAgltZVzg "Configure your external encryption key to use in External Key Management Service (EKMS).")
* [Created an Encrypted Field Configuration](https://www.servicenow.com/docs/SUsDhaRrmOYBxS10h_wX8A "Configure specific fields to be encrypted using your External Key Management Service (EKMS) cryptographic module with external Amazon Web Services Key Management System (AWS KMS) key wrapping.")
{#ekms-set-up-maps__ul_ilj_ljq_33c}

## Procedure

1. Navigate to AllSystem SecurityField EncryptionField Encryption EnterpriseConfigurationsAccess Policies.  
   Note:  
   For additional information, refer to [Configure module access policies for Field Encryption](https://www.servicenow.com/docs/n0d4HWjdevBX5MxIwBYKfQ "Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.").
2. Select Configure.
3. Complete the Module Access Policy (MAP) form.  
   {#ekms-set-up-maps__table_w2n_qfy_j3c__entry__2}

   | Field | Description |
   |-|-|
   | Policy name | Enter a name for the policy. |
   | Type | Decide who or what should have access to this MAP to encrypt or decrypt data. * Scope- Anything within the specified Application Scope has access to this MAP. * Role- Only users with the specific role can access this MAP. * Script- Ensure a specified script can access this MAP. * System Access- Allows processes running in "System Context" access to this MAP. * Resource Exchange- Allows for the Resource Exchange feature access to this MAP. {#ekms-set-up-maps__ul_s5v_px1_r3c}For more information on how these different types of MAP work, see [Exploring Field Encryption](https://www.servicenow.com/docs/wwFqug_Vzs3Al8ugFuEziw "Learn the details of Field Encryption Starter and Field Encryption Enterprise"). |
   | Target scope | Field is visible as an identifier for the Scope type. Refers to the functionality of the policy. Select the applications from the search menu. |
   | Specify purpose | Optional.  Enable  to  display  the  Crypto  Spec  field  on  the  form.  Enable this option to configure granular operations, such as some users being able to encrypt, but not decrypt.  |
   | Application | The  Application scope  is  auto-populated  by  your  current scope.  |
   | Active | Select to activate the policy. |
   | Result | Select one of the following: * **StrictReject** rejects access under all circumstances. * **Reject** rejects users with the **Target Role** or **Target Scope** from accessing this cryptographic module unless another policy grants them access. * **Track** to permit access and monitor use of the module. {#ekms-set-up-maps__create-module-access-policy_ul_a5d_jr4_tnb} |
   [Table 1. MAP Form]

   {#ekms-set-up-maps__table_w2n_qfy_j3c}

## Result

The Module Access Policy for the script is available in the system.

Next steps:

* [Test an external key definition](https://www.servicenow.com/docs/nopExf0fDtavsy3KP8VeMA "Test your external encryption key to use in External Key Management Service (EKMS).")
* [Learn how to change the status of an AWS KMS Key](https://www.servicenow.com/docs/4lClUgpu0a4eM9UXetBxtA "Modify the status of your Amazon Web Services Key Management System (AWS KMS) key and synchronize the status with your ServiceNow instance.")
{#ekms-set-up-maps__ul_vln_5zs_k3c}

*[\>]: and then