---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Column Level Encryption Enterprise walkthrough

# Column Level Encryption Enterprise walkthrough {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 3 Minuten Lesedauer

This walkthrough shows you how to encrypt a field in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.

## Vorbereitungen

Hinweis:  
This procedure only applies to Column Level Encryption Enterprise functionality. See [Activate Column Level Encryption Enterprise](https://servicenow-prod.fluidtopics.net/bd5xKPL4HnumiOslxPYuVw "With subscription to Column Level Encryption Enterprise, an admin can activate the com.glide.now.platform.encryption plugin.") for more information on obtaining Column Level Encryption Enterprise.

Role required: admin or security_admin  
Hinweis:  
security_admin is a privileged role, for details on using privileged roles, see [Elevate to a privileged role](https://servicenow-prod.fluidtopics.net/QSMW4UNBg6bevZDKAPGT2Q "The base system admin can elevate to a privileged role to have access to the features of High Security Settings.")

## Warum und wann dieser Vorgang ausgeführt wird

This walkthrough starts with an instance where you have already created and uploaded your personal cryptographic key. You could use the ServiceNow key, but this example uses a customer-supplied key.

After the key has been stored in a cryptographic module, you can start configuring fields in your instance, such as salary or social security numbers that have limited access from certain users. In the Encrypted Field
Configuration, specify which authorized personnel can access sensitive data.

This task demonstrates two scenarios. One example encrypts the Short Description field in an Incident for users who are not authorized to view the sensitive data.

Attachments can also be encrypted and only visible to users who are granted access, or is visible to all users that are not restricted from viewing the data. See [Attachment encryption walkthrough](https://servicenow-prod.fluidtopics.net/yVWx23Z5TBhJw3Fk0Ym7qg "This walkthrough shows you how to encrypt an attachment in your instance using Field Encryption Enterprise with the Key Management Framework (KMF). It also shows you how to use your own key.") to encrypt an attachment.

## Prozedur

1. Make sure that Column Level Encryption Enterprise is enabled.
2. Create a cryptographic module for column_level_encryption.  
   See [Create cryptographic module for Column Level Encryption](https://servicenow-prod.fluidtopics.net/OIYvV5bxYmy19lXHalNChA "Create a Field Encryption cryptographic module to define the mechanisms used for cryptographic operations.") [Create a cryptographic module](https://servicenow-prod.fluidtopics.net/Jy8yosmnoD7W9psp60zV_A "Create a cryptographic module to define the mechanisms used for cryptographic operations. After you create the module, you create a cryptographic specification, where you define an algorithm for encryption and generates a key.") for more information.
3. Navigate to System SecurityEncrypted Field Configurations.
4. Click New.
5. On the form, fill in the fields.  
   {#column-level-encryption-enterprise-walkthrough-2__table_rj3_tsn_tnb__entry__2}

   | Field | Description |
   |-|-|
   | Type | Column is required to use your personal key. |
   | Table | Table that stores the sensitive information. For this example, select Incident \[incident\]. |
   | Column | Column, or specific information, that represents the sensitive date to be encrypted. For this example, select short_description. |
   | Active | Option to mark Active to use the field configuration. |
   | Algorithm Equality Preserving | The option is automatically selected. |
   | Crypto module | Module that you created to use with the personal key. |
   | Method | The Single Module option is used to apply the policies for one module. Multiple Modules is used to apply the policies across multiple modules. |
   [Tabelle : 1. Encrypted field configuration form]

   {#column-level-encryption-enterprise-walkthrough-2__table_rj3_tsn_tnb}  
   Abbildung : 1. Encryption field configuration example
6. Click Submit.  
   Establish a Module Access Policy to assign access to the cryptographic module. See [Create a module access policy](https://servicenow-prod.fluidtopics.net/b5Fi_fL46STNIHpPr4rI2Q "Create module access policies to decide which users and scripts can access data encrypted by a cryptographic module.") for additional information.
7. Navigate to Key ManagementModule Access PoliciesCreate New.
8. On the form, fill in the fields.  
   {#column-level-encryption-enterprise-walkthrough-2__table_ykx_f5p_tnb__entry__2}

   | Field | Description |
   |-|-|
   | Policy name | Name for the policy, such, as <kbd class="ph userinput">short description</kbd>. |
   | Crypto module | Crypto module that you created to encrypt your key. |
   | Type | Type of access designation for the crypto policy. Use Role to grant access to the encrypted field to only those users that have the assigned role. |
   | Target Role | The role that has access to the encrypted field. For this example, select Admin. |
   | Active | Option to activate the Module Access Policy. |
   | Result | The Trackoption enables the access to the field for the selected role. (To restrict access to that field for the selected role, select Reject orStrict Reject.) |
   [Tabelle : 2. Module access policy form]

   {#column-level-encryption-enterprise-walkthrough-2__table_ykx_f5p_tnb}  
   Abbildung : 2. Module access policy example
9. Click Submit.
10. As a user with the sn_kmf.admin role, navigate to IncidentNew.  
    Abbildung : 3. Example of encrypted field visible  
    You can now view the Short description field based on the module access policy configuration.  
    Hinweis:  
    The sn_kmf.admin role was granted user access to the encrypted field, Short description, by setting the module access policy to Track. Notice the lock icon (![Lock icon.]()) under the field name indicating that the field is an encrypted field.

    You can now access the Incidents module as an end user to test the encrypted field configuration.
11. Log in as a user to be restricted from viewing the encrypted data in the configured field.  
    Abbildung : 4. Encrypted field level data  
    When you access the incident number, the data in the Short description will not be visible.
{#column-level-encryption-enterprise-walkthrough-2__steps_ikg_fnw_d3c}

## Ergebnisse

You have successfully used your symmetric key to control access to a specific field using Column Level Encryption Enterprise.