Google Cloud Compliance ControlsGoogle Cloud KMS
KMS keys should be rotated at least annually
Checks that KMS encryption keys are rotated within a set period. Checkov CKV_GCP_43 looks at `rotation_period` on `google_kms_crypto_key`. KICS says keys should be rotated every 90 days or less.
What this control checks
google_kms_crypto_key needs a rotation_period of at most 90 days; a missing period fails.
Framework mappings
The clauses this control is mapped to in each framework.
- PI1.5 Stored data is maintained complete, accurate, and protected from unauthorized modification to meet the entity's processing integrity commitments and system requirements
- 3.5.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.1: Primary account number (PAN) is secured wherever it is stored.
- 3.5.1.3: Primary account number (PAN) is secured wherever it is stored.
- 3.6.1: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.2: Cryptographic keys used to protect stored account data are secured.
8 more clauses
- 3.6.1.3: Cryptographic keys used to protect stored account data are secured.
- 3.6.1.4: Cryptographic keys used to protect stored account data are secured.
- 3.7.1: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.2: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.4: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.5: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.6: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- 3.7.7: Where cryptography is used to protect stored account data, key management processes and procedures covering all aspects of the key lifecycle are defined and implemented.
- A.8.24 Use of cryptography
- 9 Cryptography
- 11 Access control
- 12 Asset management
- CRY-05.02B The private keys used for encryption are known only to the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure.
- CRY-07.01B The cloud service provider has established a schedule for rotating cryptographic keys that aligns with the requirements for cryptographic key rotation established in CRY-01. If, based on the results of a risk analysis, the cloud service provider does not perform key rotation, this...
- CRY-09.02B Provisioned keys include activation and deactivation dates to ensure that their use is time limited.
- CRY-10.01B The cloud service provider has documented and implemented technical measures for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and...
- CRY-11.01B The cloud service provider has documented and implemented procedures and technical measures for the secure archiving of cryptographic keys. These include: - Storage of archived keys in a secure repository to prevent unauthorised access;- Restriction of access to archived keys to...
1 more clause
- CRY-19.01B The cloud service provider implements procedures and technical safeguards to ensure the secure handling of cryptographic keys managed by cloud service customers. In these procedures, the following aspects are considered: - Secure integration of customer-managed keys into the cloud...
- 164.308(a)(1)(ii)(B) Risk management
- 164.312(a)(2)(iv) Encryption and decryption
- 164.312(e)(2)(ii) Encryption
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_kms_key_rotation_enabled - Checkov Check:
CKV_GCP_43 - Powerpipe Controls:
gcp_compliance.control.cmek_rotation_one_hundred_days,gcp_compliance.control.kms_key_rotated_within_90_day - Prowler Check:
kms_key_rotation_enabled - KICS Query:
d8c57c4e-bf6f-4e32-a2bf-8643532de77b
Last reviewed: 2026-10-09