An annual key rotation policy now applies to the encrypted backup stores, and the DBA objects that rotation means weeks of rewriting petabytes of backup data. What is the accurate answer about key rotation on these systems?

On these systems the key manager, embedded or external KMIP, holds multiple encryption keys, but only one key at a time encrypts data coming into the system. A rotation policy sets how many weeks or months a key stays in effect; at rotation a new key becomes the active read-write key for new data, while earlier keys are retained so the data they protect stays readable. Nothing is decrypted and rewritten as part of rotation, which is why the work fits a normal window even on very large stores. Re-encrypting existing data is a separate operation, used for example after a key compromise, and it runs through the file-system cleaning process rather than a dedicated rewrite project. A forced full decrypt-and-re-encrypt sweep therefore describes a different procedure, not rotation. Pinning data forever to the key that created it confuses lineage with permanence: data can be moved to a new key by re-encryption when policy demands it. Equating rotation with changing the system passphrase understates the control - the passphrase protects the stored keys and is a separate, dual-authorized change, not the key rotation the policy specifies. Exam caveat: read the policy carefully - rotating the active key and re-encrypting all existing data are different projects, and only the first fits an annual calendar. Operational check: after a rotation, confirm the key manager shows the new key as active and the earlier key still in a readable state, and log the result as evidence.