---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Attachment encryption walkthrough

# Attachment encryption walkthrough {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 Minuten Lesedauer

This walkthrough shows you how to encrypt an attachment in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.

## Vorbereitungen

Hinweis:  
This procedure only applies to Field Encryption Enterprise functionality. See [Activate Field Encryption](https://servicenow-prod.fluidtopics.net/d~sW4JlJZpz95XWViCzI5w "Activate either Field Encryption Starter or Field Encryption Enterprise.") for more information on obtaining Field Encryption Enterprise.

Role required: sn_kmf.cryptographic_manager

## Warum und wann dieser Vorgang ausgeführt wird

This walkthrough starts with an instance where you have already created and uploaded your customer-supplied cryptographic key. You could use the key, but this example uses a customer-supplied key.

Upload confidential attachments in your instance and limit access from certain users.
Use Encrypted Field Configuration to specify which authorized personnel can access
sensitive data.

We show you how to encrypt attachments to only be visible to users who are granted
access, or be visible to all users that are not restricted from viewing the data. In
this example, we restrict a certain role from being able to access an attachment in
the Incidents module.  
Hinweis:  
Although you can use multiple modules with Field Encryption Enterprise, attachment encryption must use single modules.

## Prozedur

1. Make sure that Field Encryption Enterprise is enabled.
2. Create a cryptographic module.  
   See [Create cryptographic module for Field Encryption](https://servicenow-prod.fluidtopics.net/MZeItQD~5FExpCGP6lnh3A "Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.") for more information.
3. Navigate to AllSystem SecurityField EncryptionField Encryption Experience.
4. Select View module details from the Field Encryption overview to open the module record you want to configure.
5. Select Encrypted Fields and Configure.
6. Complete the form:  
   {#attachment-encryption-walkthrough__table_rj3_tsn_tnb__entry__2}

   | Field | Description |
   |-|-|
   | Table | Select the table to access the sensitive information. For this example, select Incident \[incident\]. |
   | Type | Select Attachment to use your personal key for encrypting an attachment from the selected Table For this example, select Incident. |
   | Active | Mark Active to be able to use the field configuration. Wichtig: When active, your instance is actively encrypting new data in the selected fields or attachments. Users won't have access to this data unless they have permission via an associated Module Access Policy. Don't select if the field isn't ready to begin encrypting and enforcing Module Access Policies. To verify historical data is encrypted after an Encrypted Field Configuration is active, you'll need to run a Mass Encryption Job on the column. For details, see "Schedule Mass Encryption, Decryption, or Rekeying". |
   | Encrypt by default | When selected, records that don't match row conditions will be encrypted using the Field Encryption module selected in the field below. When not selected, these records will not be encrypted. |
   | Field Encryption module | The field encryption module used by this encrypted field configuration. |
   | Column | If you have chosen Column in the Type field, select the fields to be encrypted. Hinweis: If the field you want to encrypt is not available, it isn't a supported type. The supported field types are: * Date * Date/Time * URL * HTML * Journal * Translated * Email * Phone {#attachment-encryption-walkthrough__ul_n4g_5sv_m3c} |
   | Algorithm Equality Preserving | When selecting Field Encryption Enterprise, this field is visible based on the table selected. Displays whether Equality Preserving is enabled in the field encryption module selected in the Crypto Module field. |
   | Method | The Single Module option is used to apply the policies for one module. Multiple Modules is used to apply the policies across multiple modules. |
   [Tabelle : 1. Encrypted field configuration fields]

   {#attachment-encryption-walkthrough__table_rj3_tsn_tnb}  
   Abbildung : 1. Encrypted Field Configuration table
7. Select Save.  
   Establish a Module Access Policy (MAP) to assign access to the cryptographic module. Refer to [Create a module access policy](https://servicenow-prod.fluidtopics.net/b5Fi_fL46STNIHpPr4rI2Q "Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.") for additional information.
8. Navigate to AllSystem SecurityField EncryptionField Encryption ExperienceConfigurationsAccess Policies.
9. Click Create new.
10. Select the Field Encryption (FE) module.
11. Complete the form:  
    {#attachment-encryption-walkthrough__table_ykx_f5p_tnb__entry__2}

    | Field | Description |
    |-|-|
    | Policy name | Enter a name for the policy, such, as "Attachment policy." |
    | Type | Select Role to restrict access to the encrypted field from users with the assigned role. |
    | Result | Select Strict Reject to control the access to the attachment from the selected role. (To grant access for the selected role, select Track.) |
    | Crypto module | Select the crypto module that you created to encrypt your key. |
    | Active | Select this check box to be able to use the Module Access Policy. |
    | Target Role | Select the role that will not have access to the encrypted field. For this example, select itil. |
    | Specify purpose | Optional. Enable to display the Crypto Spec field on the form. Enable this option to configure granular operations, such as some users being able to encrypt, but not decrypt. |
    | Application | The Application scope is auto-populated by your current scope. |
    [Tabelle : 2. Module access policy fields]

    {#attachment-encryption-walkthrough__table_ykx_f5p_tnb}  
    Abbildung : 2. Module Access Policy form
12. Click Submit.
13. As user with access to the encryption module, navigate to Incidents and add an attachment to the form.  
    Once the attachment is uploaded, it will be available from the Activities screen.  
    Abbildung : 3. Attachment available per role
14. Log in as a user that doesn't have access to the module.
15. Open the incident and scroll to the Activities: section.  
    The link to open the attachment isn't visible for users that don't have access to the module.

## Ergebnisse

You have successfully used your customer-supplied key to control access to a specific attachment using Field Encryption Enterprise.