ISC2 Certified Cloud Security Professional (CCSP) Practice Question

Hold Your Own Key (HYOK) keeps the cryptographic keys entirely under the customer's control, typically in an on-premises or customer-managed HSM. Because the key material never leaves the customer's security boundary, provider personnel cannot access the plaintext key, and the customer can independently perform key rotation or revocation whenever needed.

Bring Your Own Key (BYOK) improves control but the key is still imported into the provider's HSM, so the provider could theoretically access it and must participate in rotation. Provider-managed envelope encryption relies completely on keys generated and controlled by the cloud service, giving the customer little control. Dual-party key escrow splits the key, but the provider still holds a share, so it does not meet the "never exposed" requirement.