What we do

• Key ceremonies: M-of-N generation/activation, dual control, tamper-evident artefacts, backup/restore validation — see HSM Services.
• PKI integration: Offline/online CA custody, OCSP/CRL signing, profile design and issuance pipelines — see PKI design patterns.
• Code/firmware signing: provider/engine setup (CNG, PKCS#11, JCE, OpenSSL) and signing policy with audit trails.
• Cloud anchors & BYOK/KEK: envelope encryption, external key manager patterns — see Cloud HSM Services.

Deployment patterns

• On-prem HSMs: Thales Luna, Entrust nShield, Utimaco SecurityServer, IBM Crypto Express — compare at HSM Vendors.
• Cloud HSM/KMS: AWS CloudHSM, AWS KMS, Azure Managed HSM, Azure Key Vault, Google Cloud KMS, EKM, HashiCorp Vault.
• Hybrid: on-prem anchors + cloud KMS for workload keys (BYOK/KEK), residency and sovereignty controls.

Integrations & APIs

• PKCS#11 (OASIS): standard interface across vendors — OASIS PKCS#11.
• Microsoft CNG/KSP: Windows HSM integration — MS Docs.
• Java JCE/JCA: provider configuration — Oracle JCE.
• OpenSSL providers: engine/provider setup — OpenSSL.
• CLM platforms: Venafi, EJBCA, Keyfactor issuance/renewal with provenance — see Cryptographic Audits and Selected engagements.

Operations & support

• Runbooks for ceremony execution, key rotation, rollover and recovery; role segregation and access controls.
• Monitoring: HSM health, slot policies, FIPS mode, OCSP freshness, CRL age, expiry MTTR.
• Support options: steady-state assistance and HSM Support Services.

Compliance & evidence (we don’t provide legal advice)

• FIPS 140-3: validated modules when policy requires — NIST.
• PCI DSS 4.x: payment key handling, rotations, DUKPT evidence — PCI SSC.
• GDPR/UK GDPR: encryption & accountability evidence — GDPR • UK ICO.
• NIST crypto lifecycles: parameter deprecations and transitions — SP 800-131A r3 (draft) • SP 800-57.

PQC readiness

• Assess vendor roadmaps for ML-KEM/ML-DSA and firmware support; run hybrid pilots before committing — see Quantum PKI Transition.
• Understand dual private keys (seed vs expanded) and PKCS#11 implications — see Dual Private Keys & HSM Interoperability.

When to choose HSM vs KMS

• Choose HSM for CA roots/issuers, code signing, payments, and workloads needing dedicated hardware assurance.
• Choose KMS for application-level key orchestration, envelope encryption and broad platform integration.
• Hybrid when you need customer-managed anchors with cloud KMS for workload keys and automation.

What you receive

• Signed ceremony records (tamper-evident), configuration baselines and recovery runbooks.
• API/provider configurations (PKCS#11/CNG/JCE/OpenSSL) and CLM integration patterns.
• Compliance evidence pack mapped to policy, including monitoring SLOs and backup/restore validation.

HSM & cryptographic appliances — FAQ

Can you host our ceremonies on-site?

Yes — we facilitate on-prem or controlled facilities, with M-of-N, evidence artefacts and back-up validation.

Do you integrate with our PKI and CLM?

Yes — AD CS, EJBCA, Venafi and Keyfactor are common; we maintain provenance across issuance and renewal flows.

How do you handle cloud connectivity?

We design secure anchors for Azure, AWS and Google Cloud (BYOK/KEK), using cloud HSM patterns and least-privilege access.