使用 Cloud Logging 的稽核記錄：與所有 Google Cloud 服務一樣，Cloud HSM 服務會寫入稽核記錄，記錄 Google Cloud 資源中的管理活動和存取權。稽核記錄可協助您判定從事活動的人員和時間。啟用稽核記錄後，安全性、稽核和法規遵循實體就能監控 Google Cloud 資料和系統，以防範可能的安全漏洞或外部資料濫用情形。如要進一步瞭解稽核記錄，請參閱 Cloud Key Management Service 稽核記錄。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-10 (世界標準時間)。"],[],[],null,["# Cloud HSM for Google Workspace is an encryption key service that provides [client-side\nencryption (CSE)](https://support.google.com/a/answer/10741897) for\nGoogle Workspace.\n\nCloud HSM is a highly available, fully managed key management service\noperated at cloud scale with hardware-backed keys stored in FIPS 140-2 Level 3\ncompliant hardware security modules (HSMs). Cloud HSM for Google Workspace is available in\nthe United States.\n\nUsing Google Workspace CSE adds another layer of encryption to your\norganization's data, including files and emails, in addition to the default encryption\nthat Google Workspace provides. CSE is especially beneficial for organizations\nthat store sensitive or regulated data, like intellectual property, healthcare\nrecords, or financial data. Cloud HSM for Google Workspace lets you have greater control\nover your encryption keys, and can help you meet regulatory and compliance\nrequirements.\n\nHow Cloud HSM for Google Workspace works\n----------------------------------------\n\nCloud HSM for Google Workspace uses [envelope encryption](/kms/docs/envelope-encryption) to protect\nyour Google Workspace data such as files and emails. Protected data can only\nbe encrypted and decrypted by authorized users according to your identity\nprovider (IdP). All wrap and unwrap operations using Cloud HSM keys are\nperformed inside the HSM. The key material never leaves the HSM protection\nboundary.\n\nFeatures and benefits\n---------------------\n\n**Secure and standards-aligned**: Cloud HSM is built for customers who\nwant to run cloud workloads that meet stringent security and regulatory\nstandards. Cloud HSM uses FIPS 140-2 Level 3 validated Marvell\nLiquidSecurity HSMs. The Cloud HSM service has obtained compliance with\nnumerous regulations and certifications including the following:\n\n- [FedRAMP](/security/compliance/fedramp)\n- [DISA IL5](/security/compliance/disa#services-in-scope)\n- [ITAR](/security/compliance/itar)\n- [SOC 1](/security/compliance/soc-1)\n- [SOC 2](/security/compliance/soc-2)\n- [SOC 3](/security/compliance/soc-3)\n- [HIPPA](/security/compliance/hipaa-compliance)\n- [PCI DSS](/security/compliance/pci-dss)\n\nThese compliance standards and certifications help customers in highly regulated\nmarket segments meet their regulatory and compliance needs for key management\nand data protection.\n\n**Flat pricing** : Cloud HSM for Google Workspace offers flat pricing. Your costs don't\nchange based on the number of users. For more information about pricing, see\n[Cloud Key Management Service pricing](/kms/pricing).\n\n**Audit logs using Cloud Logging** : Like all Google Cloud services,\nCloud HSM service writes audit logs that record administrative\nactivities and accesses within your Google Cloud resources. Audit logs\nhelp you determine who did what, and when. Enabling audit logs helps your\nsecurity, auditing, and compliance entities monitor Google Cloud data\nand systems for possible vulnerabilities or external data misuse. For more\ninformation about audit logging, see [Cloud Key Management Service audit\nlogging](/kms/docs/audit-logging).\n\nWhat's next\n-----------\n\n- [Onboard to Cloud HSM for Google Workspace](/kms/docs/onboard-hsm-workspace).\n- Learn how [Cloud HSM](/docs/security/cloud-hsm-architecture#regulatory-compliance) can help you meet security and regulatory compliance requirements."]]
