---
schema_version: "1"
id: 28d9c151c4854aabc3891d789e7c98923e94931cb41a11f5e8da3573911ce6bc
title: Rotate a Key Encryption Key
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/mktg/264-0-0/mc_overview_encryption_kek.md
canonical_url: https://help.salesforce.com/s/articleView?id=mktg.mc_overview_encryption_kek.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 4d1bd951bfeda402ba46dafdf62a3c97a785d3d0cd16339577bd0fabd0f73f8d
description: Protect your customers by rotating the key encryption key (KEK) that’s used in the process of encrypting the data in your Marketing Cloud Engagement account. A KEK is an AES 256 cryptographic key that encrypts and decrypts other keys to provide those keys with an additional layer of protection. Work with your security and compliance teams to determine the appropriate rotation interval for your KEK. We recommend that you rotate the KEK at least one time per year. Repeat these steps at each rotation interval.
products:
  - Marketing
  - Marketing Cloud Engagement
release: "264"
---
# Rotate a Key Encryption Key

Protect your customers by rotating the key encryption key (KEK) that’s used in the process of encrypting the data in your Marketing Cloud Engagement account. A KEK is an AES 256 cryptographic key that encrypts and decrypts other keys to provide those keys with an additional layer of protection. Work with your security and compliance teams to determine the appropriate rotation interval for your KEK. We recommend that you rotate the KEK at least one time per year. Repeat these steps at each rotation interval.

### Required Editions

<table class="slds-table slds-table_bordered slds-max-medium-table_stacked slds-m-bottom_small permission">
        <colgroup>
          <col style="width:50%">
          <col style="width:50%">
        </colgroup>
        <thead class="slds-text-title_caps ">
          <tr class="">
            <th scope="colgroup" class="slds-cell-wrap" colspan="2" style="text-align:center;vertical-align:top;" id="d8299e38">User Permissions Needed</th>
          </tr>
        </thead>
        <tbody>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d8299e38 ">To view key encryption keys:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d8299e38 ">Database Encryption - View</td>

          </tr>
          <tr class="">
            <td data-label="User Permissions Needed" class="slds-cell-wrap" style="vertical-align:top;" headers="d8299e38 ">To rotate key encryption keys:</td>

            <td class="slds-cell-wrap" style="vertical-align:top;" headers="d8299e38 ">Database Encryption - Rotate Key</td>

          </tr>
        </tbody>
      </table>

To rotate key encryption keys, Bring Your Own Key (BYOK) and Field-Level Encryption must be enabled for your account. For information about enabling this feature, contact your Salesforce account executive.

1. From Setup, in the Quick Find box, enter bring your own, and then select **Bring Your Own Key**.
2. Click **New Key**, and then select **Generate Key**.
3. Create an AES 256 key and name it.
4. On the All Keys page, under Field Level Encryption Key Encryption Key (FLE KEK), select **Rotate**, and then select the key that you want to use.
5. Confirm that you want to rotate the KEK.

#### See Also

- [Create Encryption Keys for Field-Level Encryption](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_implement_field_level_encryption.htm&release=264.0.0&type=5 "Field-level encryption adds an extra layer of protection to the customer data in your data extensions. Using field-level encryption requires purchasing Marketing Cloud Engagement Professional Services to configure the necessary changes to your account. To use field-level encryption in your data extensions, complete these prerequisites.")
- [Bring Your Own Key for Encryption at Rest](https://help.salesforce.com/s/articleView?id=mktg.mc_overview_byok.htm&release=264.0.0&type=5 "Provide your own encryption key to help in encrypting data in Marketing Cloud Engagement. This feature uses an RSA2048 encryption key that you generate in your own environment. Use the key as part of encrypting data at rest using Data at Rest Encryption for a Dedicated Database Environment. This feature applies to the top-level account in your tenant and can’t be activated for individual business units. Perform all operations for this feature in the top-level account of your tenant.")