Use the Key Management Framework (KMF) to generate, exchange, store, use, and replace your cryptographic keys. KMF helps you manage keys and operations used to protect the data on your ServiceNow instance.

Key Management refers to the activities involved in handling your cryptographic keys and related security parameters during the key's life cycle. Key Management is based on National Institute of Standards and Technology (NIST) 800-57 guidelines. In accordance with these guidelines, you can use KMF to:
  • Assign dedicated roles for cryptographic management and operations, auditing, and integration.
  • Create cryptographic modules to configure of cryptographic specifications for unique cryptographic purposes and key types.
    • Symmetric key: encryption and decryption, key wrapping and unwrapping, and authentication
    • Asymmetric key: digital signature generation and verification, encryption and decryption, key wrapping and unwrapping
  • Manage your key life cycle to generate, rotate, revoke, and suspend keys, including support of several key life cycle states
  • Create module access policies (MAPs) to enforce access controls, to grant access only to users and scripts that you choose.
  • Protect your cryptographic keys with the Federal Information Processing Standard (FIPS) 140-2-L3 hardware Root of Trust (RoT), Public Key Infrastructure (PKI), key hierarchy, and envelope encryption.
  • Assign the auditing role to users to can then view auditing information such as key usage statistics.

Get started

Activation information

The ServiceNow Platform Encryption subscription bundle is a group commercial entitlement that includes Key Management Framework, Field Encryption Enterprise, Cloud Encryption, and Database Encryption.

Field Encryption Enterprise is the unlimited license of Field Encryption. The Field Encryption Enterprise plugin is available with the activation of the com.glide.now.platform.encryption plugin. For details, see Encryption and Key Management subscription bundle.

Note: KMF doesn’t support domain separation, but can be used with on-premise instances.