Abstract: Encryption keys in a communication system are updated according to rekey groups having a common set of encryption keys or CKRs. Each group includes a number of radios with active and inactive keysets. A database records the relationships between rekey groups and keys, and the status of their keysets. An operator first determines one or more keys to be updated. New keys are then transmitted to each radio in one or more rekey groups using respective rekey messages. The new keys are stored in the inactive keysets of the radios. The inactive keysets are then activated using respective changeover messages. Deployment of new keys is carried out by software in the form of automated update tasks.