SAP Key Management Service

Through flexible key scenarios like Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK), organizations can choose the level of control that best fits their compliance and security requirements.

BYOK allows customers to generate a key externally and import it into the SAP KMS tenant. This model is suited for organizations that want to generate keys using their own certified hardware security modules (HSMs) while still leveraging SAP’s managed key infrastructure for daily operations.

HYOK represents the highest level of customer control. The encryption key never leaves the customer’s external keystore. SAP KMS is connected to the customer’s external key management system and uses the permitted key for cryptographic operations without ever storing or caching it.

Flexibly assigning cloud systems to an SAP KMS tenant gives organizations full control over how encryption keys are managed across their SAP landscape.

Operational agility — Systems can be onboarded or reassigned without disrupting key management operations. As your SAP footprint evolves through new system provisioning, migrations, or reorganizations, key assignments can adapt accordingly.

Granular governance — Different systems can be grouped under dedicated KMS tenants that reflect your organizational structure (e.g., by business unit, region, or data classification). This enables clear separation of duties and targeted access controls.

Compliance alignment — Flexible assignment makes it easier to meet regulatory requirements that mandate specific key isolation or residency rules for defined system categories, without forcing a one-size-fits-all topology.

Managing encryption keys is not just a technical task — it is a compliance and governance obligation. SAP KMS addresses this through two core capabilities that work together to ensure every key operation is traceable, structured, and properly authorized.

End-to-end audit logs go beyond recording what SAP KMS itself does. Every key operation is logged. But the audit trail does not stop at the KMS boundary: when a key operation is executed, the outcome on the application side is captured as well.

4-eyes principle workflows ensure that sensitive key operations — such as creating or destroying a key — cannot be performed by a single individual. By requiring additional authorized approvers before an action takes effect, organizations enforce dual control at the process level, not just as a policy on paper. This helps mitigate insider risk and supports stringent separation-of-duties requirements.