使用 Cloud Logging 的审核日志：与所有 Google Cloud 服务一样，Cloud HSM 服务会写入审核日志，以记录 Google Cloud 资源中的管理活动和访问情况。审核日志可帮助您确定谁在何时执行了什么操作。启用审核日志有助于安全、审核和合规性实体监控 Google Cloud 数据和系统，检查是否存在可能的漏洞或外部数据滥用。如需详细了解审核日志记录，请参阅 Cloud Key Management Service 审核日志记录。
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-02。"],[],[],null,["# Cloud HSM for Google Workspace is an encryption key service that provides [client-side\nencryption (CSE)](https://support.google.com/a/answer/10741897) for\nGoogle Workspace.\n\nCloud HSM is a highly available, fully managed key management service\noperated at cloud scale with hardware-backed keys stored in FIPS 140-2 Level 3\ncompliant hardware security modules (HSMs). Cloud HSM for Google Workspace is available in\nthe United States.\n\nUsing Google Workspace CSE adds another layer of encryption to your\norganization's data, including files and emails, in addition to the default encryption\nthat Google Workspace provides. CSE is especially beneficial for organizations\nthat store sensitive or regulated data, like intellectual property, healthcare\nrecords, or financial data. Cloud HSM for Google Workspace lets you have greater control\nover your encryption keys, and can help you meet regulatory and compliance\nrequirements.\n\nHow Cloud HSM for Google Workspace works\n----------------------------------------\n\nCloud HSM for Google Workspace uses [envelope encryption](/kms/docs/envelope-encryption) to protect\nyour Google Workspace data such as files and emails. Protected data can only\nbe encrypted and decrypted by authorized users according to your identity\nprovider (IdP). All wrap and unwrap operations using Cloud HSM keys are\nperformed inside the HSM. The key material never leaves the HSM protection\nboundary.\n\nFeatures and benefits\n---------------------\n\n**Secure and standards-aligned**: Cloud HSM is built for customers who\nwant to run cloud workloads that meet stringent security and regulatory\nstandards. Cloud HSM uses FIPS 140-2 Level 3 validated Marvell\nLiquidSecurity HSMs. The Cloud HSM service has obtained compliance with\nnumerous regulations and certifications including the following:\n\n- [FedRAMP](/security/compliance/fedramp)\n- [DISA IL5](/security/compliance/disa#services-in-scope)\n- [ITAR](/security/compliance/itar)\n- [SOC 1](/security/compliance/soc-1)\n- [SOC 2](/security/compliance/soc-2)\n- [SOC 3](/security/compliance/soc-3)\n- [HIPPA](/security/compliance/hipaa-compliance)\n- [PCI DSS](/security/compliance/pci-dss)\n\nThese compliance standards and certifications help customers in highly regulated\nmarket segments meet their regulatory and compliance needs for key management\nand data protection.\n\n**Flat pricing** : Cloud HSM for Google Workspace offers flat pricing. Your costs don't\nchange based on the number of users. For more information about pricing, see\n[Cloud Key Management Service pricing](/kms/pricing).\n\n**Audit logs using Cloud Logging** : Like all Google Cloud services,\nCloud HSM service writes audit logs that record administrative\nactivities and accesses within your Google Cloud resources. Audit logs\nhelp you determine who did what, and when. Enabling audit logs helps your\nsecurity, auditing, and compliance entities monitor Google Cloud data\nand systems for possible vulnerabilities or external data misuse. For more\ninformation about audit logging, see [Cloud Key Management Service audit\nlogging](/kms/docs/audit-logging).\n\nWhat's next\n-----------\n\n- [Onboard to Cloud HSM for Google Workspace](/kms/docs/onboard-hsm-workspace).\n- Learn how [Cloud HSM](/docs/security/cloud-hsm-architecture#regulatory-compliance) can help you meet security and regulatory compliance requirements."]]
