Which key management system is recommended for large-scale encryption deployments in ONTAP?

For large-scale, enterprise, or multi-cluster environments, an external, KMIP-compliant key manager is the recommended solution. It provides centralized, secure, and robust management of encryption keys for multiple ONTAP clusters. This approach enhances security by separating keys from the data they protect and simplifies key lifecycle management (creation, rotation, revocation) across the entire infrastructure. The onboard key manager is suitable only for small, single-cluster deployments with less stringent security requirements.

A. The Local Key Manager (LKM) is onboard the cluster and not recommended for large-scale deployments due to management complexity and lack of centralization.

C. NFS-based Key Store is not a supported or standard key management method for ONTAP encryption features like NVE or NAE.

D. BlueXP Lockbox is a cloud-based key management service, but the standard for large on-premises ONTAP deployments is a dedicated KMIP server.

1. NetApp ONTAP Documentation Center. (2023). Key management in ONTAP. In ONTAP 9 Security and data encryption. The documentation states, "For large-scale or multifactor-authentication deployments, you should use an external key management server."

2. NetApp. (2022). TR-4567: NetApp ONTAP Encryption Power Guide. Section 4, "Key Management," explicitly recommends external key managers for enterprise environments for scalability and centralized control.