Cloud Encryption Standards and Best Practices

Cloud encryption standards govern how data is protected at rest, in transit, and increasingly in use across cloud infrastructure. This reference covers the principal encryption frameworks applicable to US cloud deployments, the mechanisms through which they operate, the regulatory mandates that make compliance non-negotiable, and the decision logic that determines which standard applies in a given scenario. Professionals navigating cloud service procurement, compliance audits, or security architecture will find the classification boundaries and operational distinctions here directly applicable to real-world service selection.

Definition and scope

Cloud encryption is the application of cryptographic algorithms to data stored in or transmitted through cloud environments, rendering that data unreadable to unauthorized parties regardless of where physical infrastructure resides. The scope encompasses three distinct protection states: data at rest (stored in object storage, databases, or disk volumes), data in transit (moving between clients and cloud services or between cloud regions), and data in use (processed in memory — addressed by emerging confidential computing techniques).

The National Institute of Standards and Technology (NIST SP 800-111) and (NIST SP 800-52 Rev. 2) provide the foundational standards for storage and transport encryption respectively. NIST's approved algorithm catalog — maintained under the FIPS 140-3 validation program — defines the boundary between cryptographic implementations that meet federal requirements and those that do not.

From a regulatory standpoint, encryption obligations appear across multiple frameworks. The Health Insurance Portability and Accountability Act (HIPAA Security Rule, 45 CFR §164.312) treats encryption as an addressable implementation specification for protected health information. The FedRAMP program mandates FIPS 140-validated cryptographic modules for all cloud services handling federal data. The Payment Card Industry Data Security Standard (PCI DSS v4.0) requires strong cryptography — minimum AES-128 — for cardholder data transmission across open networks.

The Cloud Defense Providers provider network indexes providers operating across these compliance frameworks.

How it works

Encryption in cloud environments operates through a layered architecture of algorithms, key management systems, and protocol implementations.

Core algorithm classes in active use:

1. Symmetric encryption — AES (Advanced Encryption Standard) with 256-bit keys is the dominant standard for data at rest. NIST designated AES in FIPS 197 and it remains the baseline for FIPS 140-3 validated modules.
2. Asymmetric encryption — RSA-2048 and RSA-4096 handle key exchange and digital signatures. NIST SP 800-131A Rev. 2 disallows RSA keys shorter than 2048 bits for federal use.
3. Transport protocols — TLS 1.2 remains widely deployed; TLS 1.3 (RFC 8446) reduces handshake latency and eliminates cipher suites vulnerable to downgrade attacks. NIST SP 800-52 Rev. 2 requires TLS 1.2 minimum and recommends TLS 1.3 for federal-facing systems.
4. Post-quantum algorithms — NIST finalized its first post-quantum cryptographic standards in 2024, including ML-KEM (FIPS 203) and ML-DSA (FIPS 204), establishing the transition pathway for quantum-resistant cloud encryption (NIST Post-Quantum Cryptography).

Key management is operationally separate from encryption algorithms. Cloud key management services (KMS) fall into three custody models: provider-managed keys, customer-managed keys (CMK) where the customer controls key material within the provider's KMS, and customer-supplied keys where key material never leaves the customer's on-premises hardware security module (HSM). The distinction has direct audit implications — FIPS 140-2 Level 3 or higher HSM validation is required for federal key custody under FedRAMP High baseline controls.

Common scenarios

Healthcare cloud deployments subject to HIPAA must encrypt PHI at rest and in transit. AES-256 for storage and TLS 1.2+ for transmission satisfy the HIPAA Security Rule's addressable specification when documented in a risk analysis. The HHS Office for Civil Rights guidance cross-references NIST SP 800-111 as an accepted methodology.

Federal agency cloud migrations under FedRAMP must use FIPS 140-validated modules for all cryptographic operations. Non-validated open-source libraries — even those implementing AES-256 correctly — fail this requirement. The FedRAMP Marketplace lists authorization status for over 300 cloud service offerings as of public program records.

Multi-cloud and hybrid architectures introduce key management fragmentation. An organization running workloads across two providers using separate CMK configurations faces an audit surface spanning both providers' KMS audit logs. The Cloud Security Alliance (CSA Cloud Controls Matrix v4.0) addresses this under control domain EKM (Encryption and Key Management), requiring documented key lifecycle policies across all environments.

Confidential computing scenarios — where sensitive computation must occur on untrusted infrastructure — rely on hardware-based Trusted Execution Environments (TEEs). Intel TDX and AMD SEV-SNP provide memory encryption isolating workloads from hypervisor access, relevant to regulated industries processing data on shared cloud hardware.

The page describes how service providers in these scenarios are classified within this reference network.

Decision boundaries

Selecting an encryption standard requires mapping data classification, regulatory jurisdiction, and key custody requirements against available implementations. The following distinctions govern that selection:

AES-128 vs. AES-256: PCI DSS v4.0 permits AES-128; NIST recommendations for long-term data protection favor AES-256 given increased security margins. Federal systems default to AES-256 under CNSS Policy No. 15.

TLS 1.2 vs. TLS 1.3: TLS 1.2 with restricted cipher suites (excluding RC4, 3DES, and export-grade suites) meets current NIST SP 800-52 Rev. 2 requirements. TLS 1.3 is mandatory for new federal system deployments under NSA guidance and eliminates static RSA key exchange, removing a class of retroactive decryption risk.

Provider-managed vs. customer-managed keys: Provider-managed keys reduce operational complexity but give the provider cryptographic access to data under legal compulsion. Customer-managed keys transfer that risk but require HSM infrastructure and key rotation procedures. Regulated sectors handling Controlled Unclassified Information (CUI) under NIST SP 800-171 require documented key management procedures regardless of custody model.

FIPS 140-2 vs. FIPS 140-3: FIPS 140-3, effective September 2019, supersedes FIPS 140-2. Modules validated under FIPS 140-2 remain acceptable through a transition period, but new procurements for federal systems should specify FIPS 140-3 validated modules. The NIST Cryptographic Module Validation Program (CMVP) maintains the active validation list.

Current-generation vs. post-quantum algorithms: Organizations with long data retention horizons — healthcare records, classified archives — face "harvest now, decrypt later" risk from adversaries storing encrypted data for future quantum decryption. NIST's 2024 post-quantum standards provide the migration target. The How to Use This Cloud Defense Resource page outlines how algorithm transitions are tracked within this network's scope.