diff --git a/fast/stages-aw/0-bootstrap/kms.tf b/fast/stages-aw/0-bootstrap/kms.tf
index 2e53f8b66..ee75fbc1c 100644
--- a/fast/stages-aw/0-bootstrap/kms.tf
+++ b/fast/stages-aw/0-bootstrap/kms.tf
@@ -13,9 +13,10 @@
 # limitations under the License.
 
 locals {
+  kms_protection_level = coalesce(var.kms_protection_level, var.assured_workloads.regime == "FEDRAMP_MODERATE" ? "SOFTWARE" : "HSM")
   version_template = {
     algorithm        = "GOOGLE_SYMMETRIC_ENCRYPTION"
-    protection_level = var.kms_protection_level
+    protection_level = local.kms_protection_level
   }
 }
 module "logging-kms" {
diff --git a/fast/stages-aw/0-bootstrap/main.tf b/fast/stages-aw/0-bootstrap/main.tf
index 6d902d667..c8bf8c25f 100644
--- a/fast/stages-aw/0-bootstrap/main.tf
+++ b/fast/stages-aw/0-bootstrap/main.tf
@@ -35,6 +35,5 @@ locals {
     kms     = var.regions.primary
   }
   # naming: environment used in most resource names
-  prefix               = join("-", compact([var.prefix, "prod"]))
-  kms_protection_level = coalesce(var.kms_protection_level, var.assured_workloads.regime == "FEDRAMP_MODERATE" ? "SOFTWARE" : "HSM")
+  prefix = join("-", compact([var.prefix, "prod"]))
 }
diff --git a/fast/stages-aw/0-bootstrap/outputs.tf b/fast/stages-aw/0-bootstrap/outputs.tf
index 26acfeb7e..a899ca5f6 100644
--- a/fast/stages-aw/0-bootstrap/outputs.tf
+++ b/fast/stages-aw/0-bootstrap/outputs.tf
@@ -108,6 +108,7 @@ locals {
     }
     assured_workloads      = merge(var.assured_workloads, { "folder" = local.assured_workload_folder })
     common_services_folder = module.branch-common-services-folder.folder.name
+    kms_protection_level   = local.kms_protection_level
     regions                = var.regions
   }
 
@@ -165,7 +166,7 @@ output "custom_roles" {
 
 output "kms_protection_level" {
   description = "KMS protection level."
-  value       = var.kms_protection_level
+  value       = local.kms_protection_level
 }
 
 output "outputs_bucket" {
diff --git a/fast/stages-aw/0-bootstrap/terraform.tfvars.sample b/fast/stages-aw/0-bootstrap/terraform.tfvars.sample
index 45a361d8a..0a32ddc96 100644
--- a/fast/stages-aw/0-bootstrap/terraform.tfvars.sample
+++ b/fast/stages-aw/0-bootstrap/terraform.tfvars.sample
@@ -75,3 +75,8 @@ assured_workloads = {
 bootstrap_project = "<bootstrap_project_id>"
 
 alert_email = "<alert_email>"
+
+# KMS protection level for CMEK keys. Leave unset to get a regime-aware default:
+# SOFTWARE for FEDRAMP_MODERATE, HSM for all other regimes (including FEDRAMP_HIGH and IL5).
+# Explicitly set to "SOFTWARE" or "HSM" to override the default.
+# kms_protection_level = "HSM"
diff --git a/fast/stages-aw/1-resman/variables.tf b/fast/stages-aw/1-resman/variables.tf
index 5d894e787..4bbb8c19d 100644
--- a/fast/stages-aw/1-resman/variables.tf
+++ b/fast/stages-aw/1-resman/variables.tf
@@ -257,9 +257,11 @@ variable "groups" {
 }
 
 variable "kms_protection_level" {
+  # tfdoc:variable:source 0-bootstrap
   description = "KMS protection level."
   type        = string
   nullable    = true
+  default     = null
 }
 
 variable "organization" {
diff --git a/fast/stages-aw/2-networking-a-fedramp/variables.tf b/fast/stages-aw/2-networking-a-fedramp/variables.tf
index 6450f2b09..c46f24975 100644
--- a/fast/stages-aw/2-networking-a-fedramp/variables.tf
+++ b/fast/stages-aw/2-networking-a-fedramp/variables.tf
@@ -237,9 +237,11 @@ variable "groups" {
 }
 
 variable "kms_protection_level" {
+  # tfdoc:variable:source 0-bootstrap
   description = "KMS protection level."
   type        = string
   nullable    = true
+  default     = null
 }
 
 variable "regime_mapping" {
diff --git a/fast/stages-aw/3-security/variables.tf b/fast/stages-aw/3-security/variables.tf
index e1867dda7..67c742dcb 100644
--- a/fast/stages-aw/3-security/variables.tf
+++ b/fast/stages-aw/3-security/variables.tf
@@ -190,9 +190,11 @@ variable "kms_keys" {
 }
 
 variable "kms_protection_level" {
+  # tfdoc:variable:source 0-bootstrap
   description = "Protection level (HSM or SOFTWARE) applied to every key in kms_keys that does not set its own version_template."
   type        = string
   nullable    = true
+  default     = null
 }
 variable "logging" {
   # tfdoc:variable:source 0-bootstrap