---
sourceDocument: Australia Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Encrypting fields and attachments

# Encrypting fields and attachments {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Once cryptographic modules are created, a security admin can define the encrypted fields configuration (EFC) and opt to encrypt a field or attachment on a table.

## How to encrypt fields {#field-encryption-key-management__section_rmd_zv4_tnb}

Note:  
Encrypted fields aren't audited by design. This behavior isn't configurable.  
1. Specify the key source: ServiceNow generated keys or your customer-supplied keys (bring your own key) in System SecurityField Encryption Settings.
2. After specifying the key source, create a cryptographic module or use an existing cryptographic module. Start with [Create a cryptographic module](https://www.servicenow.com/docs/c2M~jmt1xxwHi5RBTn8xXQ "Create a cryptographic module to define the mechanisms used for cryptographic operations. After you create the module, you create a cryptographic specification, where you define an algorithm for encryption and generates a key.") for instructions.  
   Note:  
   If you use customer-supplied keys, follow the directions in [Create cryptographic module for Field Encryption](https://www.servicenow.com/docs/2p828yCazOg3N~lx2B5tMg "Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.") and [Configure properties for customer-supplied keys](https://www.servicenow.com/docs/Fh31fDim_bHAR9~c5qID6A "If the Field Encryption Enterprise plugin is enabled, you can use system properties to define key padding, ephemeral key pair size, and a key validity period of your customer-supplied keys.").
3. Create an encrypted field configuration to define where the encryption is applied. Here, you specify the target table and choose whether to encrypt a column or attachments within the table. See [Set encrypted field configurations](https://www.servicenow.com/docs/4NR8lURSVdSMYckIruLybQ "Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.") to get started.

{#field-encryption-key-management__ol_lct_1w4_tnb}  
Note:  
See [Field Encryption Enterprise examples](https://www.servicenow.com/docs/YcoKY7c29DUtuMlaHlbPog#kmf-walkthroughs-tutorials "These examples walk you through the encryption of fields and attachments using customer-supplied keys.") that illustrates how to encrypt fields and attachments using customer-supplied keys.
* **[Set encrypted field configurations](https://www.servicenow.com/docs/4NR8lURSVdSMYckIruLybQ)**   
  Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module.
* **[Script access for cryptographic modules](https://www.servicenow.com/docs/h27jDahZ9ZlHMROuqOVvSw)**   
  Scripts can be run to access a cryptographic module policy for a cryptographic purpose.
* **[Schedule mass encryption, decryption, and rekeying jobs](https://www.servicenow.com/docs/wFXoTZv~r4tJymdkfAqVGg)**   
  Schedule encryption, decryption, and rekeying jobs to run at a time that is best for your instance.
* **[Run mass encryption or decryption](https://www.servicenow.com/docs/44zRT6y6ecOZ~pVckX2AFA)**   
  You can run mass encryption on encryption configurations, as well as a mass decryption to decrypt previously encrypted values.
* **[Upload attachments for encryption](https://www.servicenow.com/docs/HC2HpaQQ4v5WY8hm407L4Q)**   
  Protect sensitive files by encrypting record attachments using Field Encryption and Row Conditions.
* **[Module access policies for inbound email attachment encryption](https://www.servicenow.com/docs/j9WzCQe_E3n6FtD63UgcBg)**   
  Encrypting inbound email attachments associated with matched records requires one or more module access policies (MAPs).

*[\>]: and then