# 7.2 Ensure All BigQuery Tables Are Encrypted With Customer-Managed Encryption Key (CMEK) (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000233052-7-2-ensure-all-bigquery-tables-are-encrypted-with-customer-managed-encryption-key-cmek-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability - Level 2 Description: BigQuery automatically encrypts data at rest using Envelope Encryption with Google-managed cryptographic keys. However, for enhanced control over encryption, it is recommended to use Customer-Managed Encryption Keys (CMEK) to encrypt data encryption keys instead of the default Google-managed encryption keys. Rationale: Using CMEK provides organizations with greater control over encryption by allowing them to manage the keys used for encrypting data. This ensures compliance with stringent security policies and provides an additional layer of control and accountability. When CMEK is enabled, BigQuery handles the table and CMEK association, ensuring seamless encryption and decryption. Note: Google does not store your keys or have access to data encrypted with CMEK. If you lose your key, data encrypted with it cannot be recovered. Impact: Using CMEK requires additional effort to create, protect, and manage encryption keys. This can result in higher operational overhead for key lifecycle management. Default Value: By default, BigQuery uses Google-managed keys for encrypting data at rest. Audit Steps: ##### Using Google Cloud Console: 1. Navigate to BigQuery under Analytics.                     ![](https://support.icompaas.com/assets/kb/8f5c365df9f19cea.png) 2. Select the project under SQL Workspace.               ![](https://support.icompaas.com/assets/kb/2928c8fd7085e28b.png) 3. Choose a dataset and select a table.              ![](https://support.icompaas.com/assets/kb/9bf0dd2a7e622c73.png) 4. Go to the Details tab.           ![](https://support.icompaas.com/assets/kb/01bef01e6a252048.png) 5. Under Table info, confirm the presence of the Customer-managed key field.         ![](https://support.icompaas.com/assets/kb/a5149c335baed92f.png) 6. Repeat this for each table in all datasets across all projects. ##### Using Google Cloud CLI: List all datasets: bq ls Retrieve table details and verify the presence of kmsKeyName: bq show Remediation Steps: ##### Using Google Cloud CLI: To apply a Customer-Managed Encryption Key (CMEK) to an existing table: Use the following command to copy the data, applying the CMEK in the process. If you are updating the same table, set the source and destination as identical: bq cp --destination\_kms\_key source\_dataset.source\_table destination\_dataset.destination\_table Backout Plan: Step 1: Revert Encryption to Google-Managed Keys If CMEK encryption needs to be removed, create a new table without CMEK: bq cp source\_dataset.source\_table destination\_dataset.destination\_table - Drop the CMEK-encrypted table if needed. Step 2: Notify Stakeholders - If rollback is required, inform data security teams about encryption adjustments. Step 3: Restore from Backup (If Necessary) - If encryption issues persist, restore the table from a previous backup. Step 4: Validate Rollback Success - Run the audit steps again to confirm that CMEK is no longer enforced (if intentional). References: 1. [BigQuery Customer-Managed Encryption](https://cloud.google.com/bigquery/docs/customer-managed-encryption) CIS Controls:

Control

Description

IG 1

IG 2

IG 3

3.11 Encrypt Sensitive Data at Rest

Encrypt sensitive data stored on servers, applications, and databases using server-side or client-side encryption.

✅

✅


14.8 Encrypt Sensitive Information

Encrypt all sensitive information at rest using tools that require secondary authentication mechanisms separate from the operating system to access the data.


✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.