thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Hold Your Own Key (HYOK)

Model where encryption keys remain in customer-controlled systems outside the cloud provider at all times.

Definition

In HYOK, the cloud service must call out to an external key manager for every cryptographic operation. This gives maximum control and the ability to cut off provider access, but adds latency and availability dependency. Examples include AWS KMS External Key Store (XKS), Google Cloud EKM, and Microsoft Purview Double Key Encryption.

Example

Google Cloud EKM calls the customer's on-premises key manager to unwrap data keys for BigQuery.

Exam tip

HYOK is the highest-control option and the riskiest for availability.

Related terms