BYOK vs CMK for Regulated US Translation Data: Which to Choose?
BYOK is a method of supplying a key. CMK is a model of controlling a key. In common cloud usage, BYOK is a CMK scenario in which the customer imports key material generated outside the provider. A US organization that sends regulated documents to a translation vendor should choose CMK when it needs control of lifecycle, permissions and audit records. It should add BYOK only when policy requires externally generated key material.
Table of Contents
Direct answer
BYOK and CMK are not mutually exclusive options. CMK describes who manages the key: creation, rotation, disabling, deletion, permissions and audit. BYOK describes where the key material originates: outside the provider, then imported into the provider’s key management service or hardware security module (HSM).
For translation workloads, the choice applies to every system that stores or processes source documents, translation memories, term bases and deliverables. The decision should be recorded in the vendor contract, the security questionnaire and the data processing terms.
Definitions and scope
What CMK means
A customer-managed key is a key the customer creates, deletes, uses and manages. Microsoft documents that CMKs can be stored in a customer-owned key vault or HSM. The customer, not the provider, sets permissions and decides when a key is rotated, disabled or destroyed.
The control is exercised through the provider’s service. The provider’s infrastructure still performs encryption and decryption operations.
What BYOK means
Bring your own key means the customer generates or obtains key material externally, often in an on-premises HSM, and imports it. AWS describes creating a KMS key with key material that the customer supplies. Azure SQL documentation describes transparent data encryption with a customer-managed key as enabling the BYOK scenario.
A BYOK key becomes a CMK after import. A CMK does not have to be BYOK, because the customer can have the provider’s service generate it inside a customer-owned vault.
What neither term means
Neither term means the provider cannot use the key. AWS states that imported material remains the customer’s responsibility while AWS KMS uses a copy. If the requirement is that key material stay outside the provider, the options are different: external key management, external key stores, hold-your-own-key (HYOK) designs or client-side encryption.
Scope of this reference
This text covers United States organizations in pharmaceutical manufacturing, biotechnology, medical devices, legal services, banking and software. It covers documents such as clinical study reports, device instructions for use, contracts, regulatory submissions and financial disclosures. It covers data categories such as protected health information, confidential legal material and nonpublic financial information. It does not give legal advice. Statutory duties under HIPAA and state laws should be confirmed with counsel [VERIFY].
Steps to decide and implement
Implementation is service-specific. There is no universal BYOK or CMK setup process across US cloud services. The steps below assign an owner and a control to each stage.
Inventory the data flows. Owner: localization operations with security. List every system that holds source files, translation memories, term bases, machine output and final files. Control: a data map reviewed at each vendor change.
Classify the data. Owner: compliance or regulatory affairs. Mark which documents contain protected health information, trade secrets or privileged material. Control: a classification label attached to each project.
State the key requirement in writing. Owner: chief information security officer (CISO). Decide whether the requirement is control of lifecycle (CMK), external origin of key material (BYOK), or external custody (external key store, HYOK or client-side encryption). Control: an approved key management standard.
Check provider support. Owner: security architecture. Confirm which services, regions and features support the model. Control: a written vendor response, not a sales statement.
Define key operations. Owner: key custodians. Document generation, storage, access, rotation, compromise recovery, revocation and destruction. NIST SP 800-57 Part 1 and the OWASP Key Management Cheat Sheet frame key management as this full lifecycle. Control: separation of duties between key administrators and data users.
Configure access control. Owner: cloud administrators. Grant the provider’s service identity only the permissions it needs, such as wrap and unwrap. Control: least privilege and periodic access review.
Enable the audit trail. Owner: security operations. Log every key use, change and permission grant. Control: log retention and alerting on key disablement or deletion.
Test recovery and disablement. Owner: business continuity lead. Rehearse a key rotation, a key loss and a deliberate revocation. Control: a documented test result with the date and the observed effect on translation projects.
Write the contract terms. Owner: legal and procurement. Specify provider access, data residency, subprocessors, logging, retention and what happens to data when a key is disabled. Control: contract schedules and audit rights.
Decision criteria
The central question is whether the control requirement concerns who manages the key lifecycle or where key material originates and remains. Microsoft’s documentation supports this split.
Criterion | CMK | BYOK | External key store, HYOK or client-side |
Key generated by | Customer, in customer-owned vault or HSM | Customer, outside the provider, then imported | Customer, outside the provider |
Lifecycle control | Customer | Customer | Customer |
Key material held by provider | Yes, inside the customer vault | Yes, an imported copy | No |
Customer retains original copy | Not necessarily | Yes, and it is the customer’s responsibility | Yes |
Operational burden | Moderate | Higher | Highest |
Service compatibility | Broad | Narrower | Narrowest |
Typical trigger | Audit evidence of control | Policy on external key generation | Policy that the provider must not hold key material |
The NIST analysis of cloud key management explains that the customer owns the data while the provider controls much of the infrastructure and often the KMS environment. That is why the decision is a shared-responsibility decision and not an encryption checkbox.
Apply these tests in order:
Audit evidence. If auditors need proof that the organization controls rotation, permissions and logs, CMK is sufficient.
Key origin policy. If an internal standard requires keys to be generated in a company-controlled HSM, add BYOK.
Custody requirement. If the provider must be unable to use the key, evaluate external key management. Expect reduced service compatibility and more operational responsibility. Verify supported regions, services, availability, recovery and incident procedures first.
Data category. Protected health information and privileged legal material justify the stricter path more readily than marketing copy.
Operational capacity. A key custodian team is needed for BYOK and external models. Without it, loss or mismanagement of key material becomes a larger risk than provider access.
Examples
Medical device labeling
A US device manufacturer sends instructions for use for translation into several languages. The documents are not protected health information, but they are confidential before release. The stated requirement is audit evidence of control. CMK in a customer-owned vault, with an audit trail and least-privilege access, meets it. BYOK adds cost without a stated driver.
Clinical documentation with patient data
A biotechnology company translates case report forms that include health information. Internal policy requires keys to be generated in an on-premises HSM. BYOK applies. The company imports the key into the provider’s KMS and keeps the original under its own backup and recovery procedure. Counsel should confirm HIPAA obligations and any business associate agreement terms [VERIFY].
Legal discovery material
A law firm translates privileged documents. Client contracts require that the provider cannot decrypt content. BYOK does not satisfy this, because the provider’s service uses the imported copy. The firm evaluates an external key store or client-side encryption and accepts the reduced feature set.
AI service configuration
A localization team enables a language model service. Azure OpenAI documentation states that CMK offers more flexibility to create, rotate, disable and revoke access, and allows auditing of the keys. The team checks the prerequisites in that documentation, including a key vault, soft delete and purge protection settings, and an authorized managed identity.
Failure modes and mitigations
Failure mode | Effect | Mitigation |
BYOK treated as HYOK | Provider can still use the key, contrary to the stated policy | Write the custody requirement explicitly and test it against provider documentation |
Original key material lost | Imported key cannot be re-created, data may become unreadable | Backup under dual control, recovery test, documented custodians |
Key disabled without a plan | Translation projects stop, deliverables are unreadable | Run a disablement drill and record the effect on each workflow |
Overbroad permissions | Unneeded identities can use the key | Least privilege, periodic access review, separation of duties |
No audit trail | No evidence for auditors after an incident | Enable key-use logging and retain logs under policy |
Subprocessors outside the key model | Copies of files sit in systems not covered by the key | Map subprocessors and require them in the contract |
Unsupported service in the chosen model | Feature unavailable or project delayed | Verify service and region compatibility before commitment |
Residual unencrypted copies | Local drafts and email attachments bypass the key | Prohibit file exchange outside the controlled platform |
Key ownership alone is not a security control. The control is the documented lifecycle, with access control, audit trail, backup and a tested destruction or disablement procedure.
Vendor duties in translation engagements
A translation vendor handling regulated documents should be able to state in writing:
where files, translation memories and term bases are stored, and in which jurisdiction;
which parties can access plaintext, including linguists, reviewers and administrators;
how access control and the audit trail are enforced;
which subprocessors are used and what they can see;
whether the vendor supports customer-managed keys, and in which components;
how deletion and key disablement affect stored assets;
how quality assurance is performed and documented.
These answers belong in the contract and in the security review, not only in a questionnaire.
Where AD VERBUM fits
AD VERBUM provides AI+HUMAN hybrid translation on a proprietary LangOps System hosted on EU servers. Its certifications include ISO 27001, ISO 42001, ISO 17100, ISO 18587 and ISO 13485, independently audited by Bureau Veritas, and it aligns to GDPR and HIPAA. Reviewers are subject-matter experts. Clients should request written confirmation of the key management model for their project during scoping. See the AD VERBUM services page or the company site.
— Eric Brown
Key points
BYOK is a subtype of CMK in common cloud usage, not a separate alternative.
CMK answers who manages the lifecycle. BYOK answers where key material originates.
BYOK does not mean the provider cannot use the key.
External key stores, HYOK or client-side encryption address custody outside the provider.
Implementation differs by service, so verify prerequisites and limitations in vendor documentation.
Require access control, separation of duties, audit trail, backup and a tested disablement procedure.
Put provider access, residency, subprocessors, logging and retention in the contract.
FAQ
Is BYOK more secure than CMK?
Not by definition. BYOK adds external key generation and an original copy under customer control. It also adds operational duties, because the customer must protect that original. Security depends on the key lifecycle controls, not on the acronym.
What is the difference between BYOK and HYOK?
With BYOK, the customer imports key material into the provider’s key service, and the provider uses it. With HYOK, the key stays outside the provider and the provider cannot use it directly. AWS documents an External Key Store as one way to keep key use external.
Does key management matter for translation projects?
Yes, when source files, translation memories or term bases contain regulated or confidential content. The keys protect stored assets at rest. Access control, audit trail and subprocessor terms cover the rest of the exposure.
Can a CMK be disabled to cut off a provider?
In most customer-managed models, disabling or revoking the key stops decryption through that service. The effect on each workflow differs, so run a disablement test and record the result before relying on it.
Sources
