---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Rotate encryption keys

# Rotate encryption keys {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 Minuten Lesedauer

Perform encryption key rotation from the instance. Add a new key, change the default key
assignment, and then schedule a mass key rotation or a single key rotation.

Before setting an encryption key as the default key, make the key available to each proxy. This
ensures that the proxies have the key to encrypt data when the key is assigned as the default
key. All proxies must have access to a key before that key can be assigned as the default
key.  
Warnung:  
Before deleting a key from the proxy, set up and run a mass key rotation job to ensure that no data on the instance uses the key. If any information is still encrypted with that key, you cannot decrypt the information after you delete the key.

## Edge filtering and sorting behavior {#c_EncryptionKeyRotation__section_uqn_dpf_dfb}

Whenever you change default keys, be sure to perform a key rotation (either mass or single key rotation). Otherwise, you may receive unexpected results when sorting and filtering records. For example, consider the following scenario:

1. You create encrypted records using one encryption key.
2. You create a new key and set it as default.
3. You create a new set of encrypted records using the new encryption key.
{#c_EncryptionKeyRotation__ul_wcl_pmx_cfb}If you filter by any encrypted field when connected through the Edge proxy, all records may not be filtered out correctly, or records may appear unexpectedly. The filter works only for records encrypted using the current default key. The records encrypted using the previous default key still appear in the list view.

If you sort by any encrypted field when connected through the Edge proxy, you see two groups
of records with the same human readable text in the encrypted field.

## Schedule a single key rotation job {#ariaid-title2}

Schedule a job to find data encrypted using a specified key alias and then re-encrypt
the data with the current default encryption key. The data is decrypted before it is
re-encrypted with the default key.

### Vorbereitungen

Role required: security_admin

Before scheduling this job, update the default key
in Edge Encryption ConfigurationEncryption Key ConfigurationSet Default Keys.

### Prozedur

1. Navigate to Edge Encryption ConfigurationMaintenanceSchedule Single Key Rotation.
2. Fill in the fields on the form as appropriate.  
   {#t_RunSingleKeyRotationJob__table_xss_4g2_zs__entry__2}{#t_RunSingleKeyRotationJob__audited-fields}

   | Field | Value |
   |-|-|
   | Name | Enter a descriptive name. |
   | Job Type | Select Single Key Rotation. |
   | Key | Enter the key to be retired. Verify that this key is no longer the default key in Edge Encryption ConfigurationEncryption Key ConfigurationSet Default Keys. |
   | Estimate record count | Total estimated number of records to process. Not available when running a single key rotation. |
   | Process Historical Records | Select to process historical records in the Audit table if the field is audited. When encrypting historical records for a field in the Audit table, both new values and old values are encrypted. This field is read only and active. To learn more about audited fields, see [Auditing](https://servicenow-prod.fluidtopics.net/__Zgq5zmBL6YGcXpXQT~5Q "Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others."). |
   | Estimate Maximum Audit Record Count | Estimated maximum number of audited records to process. Not available when running a single key rotation. |
   | Active | Clear this check box if you want to deactivate this job. |
   | Run | Select the period between job executions. |
   | Starting | Enter the date and time to run the job for the first time. |
   [ ]

   {#t_RunSingleKeyRotationJob__table_xss_4g2_zs}
3. Click the menu icon in the form header and select Save.  
   Estimate Record Count is not supported when processing audited fields.

## Schedule a mass key rotation job {#ariaid-title3}

Schedule a job to find data encrypted with any previous key, and then re-encrypt the
data with the current default encryption keys. The data is decrypted before it is
re-encrypted with the current default key.

### Vorbereitungen

Role required: security_admin

### Prozedur

1. Navigate to AllEdge Encryption ConfigurationMaintenanceSchedule Mass Key Rotation.
2. Fill in the fields on the form as appropriate.  
   {#t_RunMassKeyRotationJob__table_xss_4g2_zs__entry__2}{#t_RunMassKeyRotationJob__audited-fields}

   | Field | Value |
   |-|-|
   | Name | Enter a descriptive name. |
   | Job Type | Select Mass Key Rotation. |
   | Estimate record count | Total estimated number of records to process. Not available when running a mass key rotation. |
   | Process Historical Records | Select to process historical records in the Audit table if the field is audited. When encrypting historical records for a field in the Audit table, both new values and old values are encrypted. This field is read only and active. To learn more about audited fields, see [Auditing](https://servicenow-prod.fluidtopics.net/__Zgq5zmBL6YGcXpXQT~5Q "Track record changes on auditing-enabled tables. By default, the system tracks changes to the incident, change, and problem tables, among others."). |
   | Estimate Maximum Audit Record Count | Estimated maximum number of audited records to process. Not available when running a mass key rotation. |
   | Active | Clear this check box to deactivate this job. |
   | Run | Select the period between job executions. |
   | Starting | Enter the date and time to run the job for the first time. |
   [ ]

   {#t_RunMassKeyRotationJob__table_xss_4g2_zs}
3. Click the menu icon in the form header and select Save.  
   Estimate Record Count is not supported when processing audited fields.

## Schedule an attachment key rotation job {#ariaid-title4}

Schedule a job to find attachments encrypted using a specified key alias, and then
re-encrypt the attachments with the current default encryption key. The attachment is
decrypted before it is re-encrypted with the default key.

### Vorbereitungen

Role required: security_admin

### Prozedur

1. Navigate to AllEdge Encryption ConfigurationMaintenanceSchedule Attachment Key Rotation.
2. Fill in the fields on the form as appropriate.  
   {#t_RunAttachmentKeyRotation__table_xss_4g2_zs__entry__2}

   | Field | Value |
   |-|-|
   | Name | Enter a descriptive name. |
   | Job Type | Select Attachment Key Rotation. |
   | Active | Clear the check mark if you want to deactivate this job. |
   | Table | Select a table. |
   | Run | Select the period between job executions. |
   | Starting | Enter the date and time to run the job for the first time. |
   [ ]

   {#t_RunAttachmentKeyRotation__table_xss_4g2_zs}
3. Click the menu icon in the form header and select Save.
4. To see an estimated count of records to be updated, click Estimated Record Count.
5. To run the job immediately, click Execute Now.