Encrypting fields and attachments
Once cryptographic modules are created, a security admin can define the encrypted fields configuration (EFC) and opt to encrypt a field or attachment on a table.
How to encrypt fields
Note: Encrypted fields aren’t audited by design. This behavior isn’t configurable.
- Specify the key source: ServiceNow generated keys or your customer-supplied keys (bring your own key) in System Security > Field Encryption Settings.
After specifying the key source, create a cryptographic module or use an existing cryptographic module. Start with Create a cryptographic module for instructions.
Note: If you use customer-supplied keys, follow the directions in Create cryptographic module for Field Encryption and Configure properties for customer-supplied keys.
Create an encrypted field configuration to define where the encryption is applied. Here, you specify the target table and choose whether to encrypt a column or attachments within the table. See Set encrypted field configurations to get started.
Note: See Field Encryption Enterprise examples that illustrates how to encrypt fields and attachments using customer-supplied keys.
- Set encrypted field configurations
Configure which table columns or attachments that the system encrypts using a preconfigured cryptographic module. - Script access for cryptographic modules
Scripts can be run to access a cryptographic module policy for a cryptographic purpose. - Schedule mass encryption, decryption, and rekeying jobs
Schedule encryption, decryption, and rekeying jobs to run at a time that is best for your instance. - Run mass encryption or decryption
You can run mass encryption on encryption configurations, as well as a mass decryption to decrypt previously encrypted values. - Upload attachments for encryption
Protect sensitive files by encrypting record attachments using Field Encryption and Row Conditions. - Module access policies for inbound email attachment encryption
Encrypting inbound email attachments associated with matched records requires one or more module access policies (MAPs).
Parent Topic:Using Field Encryption
Parent Topic:Using Column Level Encryption