Google Workspace CSE を使用すると、Google Workspace が提供するデフォルトの暗号化に加えて、ファイルやメールなどの組織のデータに暗号化のレイヤが追加されます。CSE は、知的財産、医療記録、財務データなどの機密データや規制対象データを保存する組織にとって特にメリットがあります。Cloud HSM for Google Workspace を使用すると、暗号鍵をより詳細に制御し、規制とコンプライアンスの要件を満たすことができます。
Cloud HSM for Google Workspace の仕組み
Cloud HSM for Google Workspace は、エンベロープ暗号化を使用して、ファイルやメールなどの Google Workspace データを保護します。保護されたデータは、ID プロバイダ（IdP）に従って、承認されたユーザーのみが暗号化と復号を行うことができます。Cloud HSM 鍵を使用するラップとラップ解除のオペレーションはすべて HSM 内で実行されます。鍵マテリアルが HSM 保護境界の外部に出ることはありません。
Cloud Logging を使用した監査ログ: すべての Google Cloud サービスと同様に、Cloud HSM サービスは、 Google Cloud リソース内の管理アクティビティとアクセスを記録する監査ログを書き込みます。監査ログは、誰がいつ何をしたかを判断するために役立ちます。監査ログを有効にすると、セキュリティ、監査、コンプライアンス エンティティが Google Cloud のデータとシステムをモニタリングして、脆弱性や外部データの不正使用の可能性を確認できます。監査ロギングの詳細については、Cloud Key Management Service の監査ロギングをご覧ください。
[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-09-10 UTC。"],[],[],null,["# Cloud HSM for Google Workspace is an encryption key service that provides [client-side\nencryption (CSE)](https://support.google.com/a/answer/10741897) for\nGoogle Workspace.\n\nCloud HSM is a highly available, fully managed key management service\noperated at cloud scale with hardware-backed keys stored in FIPS 140-2 Level 3\ncompliant hardware security modules (HSMs). Cloud HSM for Google Workspace is available in\nthe United States.\n\nUsing Google Workspace CSE adds another layer of encryption to your\norganization's data, including files and emails, in addition to the default encryption\nthat Google Workspace provides. CSE is especially beneficial for organizations\nthat store sensitive or regulated data, like intellectual property, healthcare\nrecords, or financial data. Cloud HSM for Google Workspace lets you have greater control\nover your encryption keys, and can help you meet regulatory and compliance\nrequirements.\n\nHow Cloud HSM for Google Workspace works\n----------------------------------------\n\nCloud HSM for Google Workspace uses [envelope encryption](/kms/docs/envelope-encryption) to protect\nyour Google Workspace data such as files and emails. Protected data can only\nbe encrypted and decrypted by authorized users according to your identity\nprovider (IdP). All wrap and unwrap operations using Cloud HSM keys are\nperformed inside the HSM. The key material never leaves the HSM protection\nboundary.\n\nFeatures and benefits\n---------------------\n\n**Secure and standards-aligned**: Cloud HSM is built for customers who\nwant to run cloud workloads that meet stringent security and regulatory\nstandards. Cloud HSM uses FIPS 140-2 Level 3 validated Marvell\nLiquidSecurity HSMs. The Cloud HSM service has obtained compliance with\nnumerous regulations and certifications including the following:\n\n- [FedRAMP](/security/compliance/fedramp)\n- [DISA IL5](/security/compliance/disa#services-in-scope)\n- [ITAR](/security/compliance/itar)\n- [SOC 1](/security/compliance/soc-1)\n- [SOC 2](/security/compliance/soc-2)\n- [SOC 3](/security/compliance/soc-3)\n- [HIPPA](/security/compliance/hipaa-compliance)\n- [PCI DSS](/security/compliance/pci-dss)\n\nThese compliance standards and certifications help customers in highly regulated\nmarket segments meet their regulatory and compliance needs for key management\nand data protection.\n\n**Flat pricing** : Cloud HSM for Google Workspace offers flat pricing. Your costs don't\nchange based on the number of users. For more information about pricing, see\n[Cloud Key Management Service pricing](/kms/pricing).\n\n**Audit logs using Cloud Logging** : Like all Google Cloud services,\nCloud HSM service writes audit logs that record administrative\nactivities and accesses within your Google Cloud resources. Audit logs\nhelp you determine who did what, and when. Enabling audit logs helps your\nsecurity, auditing, and compliance entities monitor Google Cloud data\nand systems for possible vulnerabilities or external data misuse. For more\ninformation about audit logging, see [Cloud Key Management Service audit\nlogging](/kms/docs/audit-logging).\n\nWhat's next\n-----------\n\n- [Onboard to Cloud HSM for Google Workspace](/kms/docs/onboard-hsm-workspace).\n- Learn how [Cloud HSM](/docs/security/cloud-hsm-architecture#regulatory-compliance) can help you meet security and regulatory compliance requirements."]]