AM-02 Asset Inventory
Changed since C5:2020 · formerly AM-01
Basic criterion
Replaced requirement for inventorying assets with the more specific requirement of maintaining hardware and software asset inventories.
Added requirement about maintaining a list of users with access to a specific resource and their respective access rights.
Wording in C5:2020
Basic criterion
The Cloud Service Provider has established procedures for inventorying assets.
The inventory is performed automatically and/or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset lifecycle.
Assets are recorded with the information needed to apply the Risk Management Procedure (Cf. OIS-07), including the measures taken to manage these risks throughout the asset lifecycle. Changes to this information are logged.
Supplementary information on all sub-criteria
Cloud service providers who procure their cloud infrastructure as virtual infrastructure from service organisation (e.g. virtual machines or containers) may use tools provided by the service organisation to inventory those assets, insofar as the cloud service provider deems these suitable based on their asset management framework.
In practice, the implementation of the asset inventory can vary greatly depending on the number, size and complexity of provided cloud services.
Basic criterion
The cloud service provider maintains an asset inventory of hardware and software assets in accordance with the asset management framework (cf. AM-01).
The inventory is performed automatically and/or by the people or teams responsible for the assets to ensure complete, accurate, valid and consistent inventory throughout the asset lifecycle.
Assets are recorded with the information needed to apply the risk management procedure (cf. OIS-07), including the measures taken to manage these risks throughout the asset lifecycle.
Changes to the recorded information of an asset are logged.
The cloud service provider maintains lists of all users under its responsibility who have access to a specific resource, along with their respective access rights.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources