CloudHSM vs. On-premise HSM Comparison

	On-premise HSM	CloudHSM as a Service
Cost	CAPEX investment required to buy the hardware. On-site team needed for deployment and configuration. Remote administration for continuous maintenance.	No installation or CAPEX required, no hardware needed. All-inclusive maintenance, software updates, and troubleshooting. Predictable costs over time.
Time	Time for delivery, installation, and setup. Scaling up requires additional equipment and installation. Staff training required to operate HSMs.	Implementation and setup take only a few days.
Space	Physical hardware requires rack space, power, cooling, physical access control.	Zero rack space required for the same level of hardened security.
Operations	Need to take regular device backups. Need to store them securely and in redundant locations. Regular maintenance tasks such as firmware updates. Need to store HSM administrator credentials securely and in redundant locations.	Backups are managed for you by Securosys. Optionally: For full control, you can additionally take backups yourself with remote Partition Administration. HSM administration and maintenance done for you (such as firmware updates).

When to choose a CloudHSM vs. an on-premise HSM?

Choose a CloudHSM if you need:

• A pay-as-you-go solution with transparent cost control.
• A quick and easy setup.
• No rack space to host the hardware.
• No ongoing hardware maintenance.

Choose an on-premise HSM if you need:

• Full ownership of the hardware.
• Full physical control over the hardware, including who has access to the rack space, or which networks the HSM is physically connected to.
• Full control over the HSM configuration, e.g., the geographic cluster configuration.
• Compliance with strict regulations (e.g., financial institutions, government).

tip

Many organizations require both a production and a testing environment. It is possible to combine an on-premise HSM in production with a CloudHSM for testing.

You might be interested in

• Getting Started with CloudHSM
• CloudHSM vs. KMS
• How to integrate Securosys CloudHSM with AWS KMS
• How to integrate Securosys CloudHSM with Bring Your Own Key (BYOK)