Key Management System.

A centralised service that generates, stores, rotates, and audits cryptographic keys on behalf of applications, typically backed by hardware security modules. It belongs to the Cryptography category of cybersecurity.

A centralised service that generates, stores, rotates, and audits cryptographic keys on behalf of applications, typically backed by hardware security modules.

A Key Management System (KMS) is the trust anchor for an organisation's cryptographic keys. It handles the full lifecycle — generation, storage, distribution, rotation, revocation, archival, and destruction — while exposing operations such as encrypt, decrypt, sign, and verify through an API rather than releasing the raw key. Production KMS implementations are backed by FIPS 140-2/3 validated hardware security modules and enforce role-based policies, quorum approvals, and tamper-evident audit logs. Common offerings include AWS KMS, Google Cloud KMS, Azure Key Vault, and self-hosted HashiCorp Vault Transit. KMS is the cornerstone of envelope encryption, BYOK/HYOK strategies, and compliance regimes such as PCI DSS, HIPAA, and FedRAMP.

Defences for Key Management System typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: KMS, Cryptographic key management.