Protect your customers by rotating the key encryption key (KEK) that’s used in the
process of encrypting the data in your Marketing Cloud Engagement account. A KEK is an AES 256
cryptographic key that encrypts and decrypts other keys to provide those keys with an additional
layer of protection. Work with your security and compliance teams to determine the appropriate
rotation interval for your KEK. We recommend that you rotate the KEK at least one time per year.
Repeat these steps at each rotation interval.
Required Editions
| User Permissions Needed |
| To view key encryption keys: |
Database Encryption - View |
| To rotate key encryption keys: |
Database Encryption - Rotate Key |
To rotate key encryption keys, Bring Your Own Key (BYOK) and Field-Level Encryption must be
enabled for your account. For information about enabling this feature, contact your Salesforce
account executive.
-
From Setup, in the Quick Find box, enter bring your own, and then
select Bring Your Own Key.
-
Click New Key, and then select Generate
Key.
-
Create an AES 256 key and name it.
-
On the All Keys page, under Field Level Encryption Key Encryption Key (FLE KEK), select
Rotate, and then select the key that you want to use.
-
Confirm that you want to rotate the KEK.
