ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Because the organization must retain exclusive control of the keys while still taking advantage of the cloud service's native features, the keys should be generated and escrowed by the customer and then supplied to the provider's key management service for server-side encryption. Using client-side encryption with customer-managed keys delivered through a bring-your-own-key (BYOK) process meets this need: the data is encrypted before it leaves the enterprise, and the provider receives only an imported key that the customer can revoke or replace at any time. Relying on provider-managed keys (server-side or disk-level encryption) violates the requirement for sole key control. Tokenization that stores surrogate values or keys in the provider's vault also fails to meet the mandate because the provider would hold the sensitive mapping information.