Google Cloud Compliance ControlsGoogle Cloud KMS
Customer-managed encryption keys should be rotated within 100 days
Evaluates customer-managed encryption keys (CMEK) in Cloud KMS and reports whether each key is rotated within 100 days. Each key receives its own result, so keys that exceed the 100 day rotation window can be identified individually.
What this control checks
Customer-managed encryption keys must be rotated within 100 days
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.RM-02: Risk appetite and risk tolerance statements are established, communicated, and maintained.
- PR.DS-01
- 1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
- 1.10 Ensure KMS Encryption Keys Are Rotated Within a Period of 90 Days
- 1.10 Ensure KMS encryption keys are rotated within a period of 90 days
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cmek_rotation_one_hundred_days - Checkov Check:
CKV_GCP_43 - Powerpipe Controls:
gcp_compliance.control.cmek_rotation_one_hundred_days,gcp_compliance.control.kms_key_rotated_within_90_day - Prowler Check:
kms_key_rotation_max_90_days - KICS Query:
d8c57c4e-bf6f-4e32-a2bf-8643532de77b
Last reviewed: 2026-10-09