---
sourceDocument: Yokohama Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/platform-security

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Attachment encryption walkthrough

# Attachment encryption walkthrough {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

This walkthrough shows you how to encrypt an attachment in your instance using Column Level Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.

## Before you begin

Note:  
This procedure only applies to Column Level Encryption Enterprise functionality. See [Activate Field Encryption Enterprise](https://www.servicenow.com/docs/r1Uk~z~P3egwvOPMHBnbgQ "Activate either Field Encryption Starter or Field Encryption Enterprise.") for more information on obtaining Column Level Encryption Enterprise.

Role required: kmf cryptographic manager

## About this task

This walkthrough starts with an instance where you have already created and uploaded your customer-supplied cryptographic key. You could use the key, but this example uses a customer-supplied key.

Upload confidential attachments in your instance and limit access from certain users.
Use Encrypted Field Configuration to specify which authorized personnel can access
sensitive data.

We show you how to encrypt attachments to only be visible to users who are granted
access, or be visible to all users that are not restricted from viewing the data. In
this example, we restrict a certain role from being able to access an attachment in
the Incidents module.  
Note:  
Although you can use multiple modules with Column Level Encryption Enterprise, attachment encryption must use single modules.

## Procedure

1. Make sure that Column Level Encryption Enterprise is enabled.
2. Create a cryptographic module.  
   See [Create cryptographic module for Field Encryption](https://www.servicenow.com/docs/iWpnIVjpLCG5kUySh2KHfg "Create a Column Level Encryption cryptographic module to define the mechanisms used for cryptographic operations.") for more information.
3. Navigate to System SecurityEncrypted Field Configurations.
4. Click New.
5. Complete the form:  
   {#attachment-encryption-walkthrough__table_rj3_tsn_tnb__entry__2}

   | Field | Description |
   |-|-|
   | Type | Select Attachment to use your personal key for encrypting an attachment from the selected Table For this example, select Incident. |
   | Table | Select the table to access the sensitive information. For this example, select Incident \[incident\]. |
   | Active | Mark Active to be able to use the field configuration. |
   | Algorithm Equality Preserving | When selecting Column Level Encryption Enterprise, this field is visible based on the table selected. |
   | Crypto module | Select the module that you created to use with the personal key. |
   | Method | The Single Module option is used to apply the policies for one module. Multiple Modules is used to apply the policies across multiple modules. |
   [Table 1. Encrypted field configuration fields]

   {#attachment-encryption-walkthrough__table_rj3_tsn_tnb}  
   Figure 1. Encrypted Field Configuration table
6. Click Submit.  
   Establish a Module Access Policy to assign access to the cryptographic
   module. Refer to [Create a module access policy](https://www.servicenow.com/docs/nxRVEUO2pFegrVeDnM9X7A "Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.") for
   additional information.
7. Navigate to Key ManagementModule Access PoliciesAll.
8. Click New.
9. Complete the form:  
   {#attachment-encryption-walkthrough__table_ykx_f5p_tnb__entry__2}

   | Field | Description |
   |-|-|
   | Policy name | Enter a name for the policy, such, as "Attachment policy." |
   | Crypto module | Select the crypto module that you created to encrypt your key. |
   | Type | Select Role to restrict access to the encrypted field from users with the assigned role. |
   | Target Role | Select the role that will not have access to the encrypted field. For this example, select itil. |
   | Active | Select this check box to be able to use the Module Access Policy. |
   | Result | Select Strict Reject to control the access to the attachment from the selected role. (To grant access for the selected role, select Track.) |
   [Table 2. Module access policy fields]

   {#attachment-encryption-walkthrough__table_ykx_f5p_tnb}  
   Figure 2. Module Access Policy form
10. Click Submit.
11. As admin or as a person that created the incident, navigate to Incidents and add an attachment to Activities on the Notes related list.  
    Figure 3. Attachment available per role
12. Log in as a user that restricted from accessing the encrypted attachment.
13. Open the incident and scroll to the Activities: section.  
    The link to open the attachment is not accessible for users with the restricted role.
14. You have now successfully used your customer-supplied key to control access to a specific attachment using Column Level Encryption Enterprise.

*[\>]: and then