AM-04 Software Asset Inventory
New in C5:2026
Basic criterion
The cloud service provider maintains a comprehensive inventory of all software assets, including used software (cf. AM-02). This inventory includes information for each entry that:
- Enables the identification of the software asset;
- Provides visibility into which other assets use the software asset for the provision of the cloud service; and
- Enables the cloud service provider to control the software asset, perform a risk assessment and protect its information security.
Supplementary information
This basic criterion can, but does not have to, be fulfilled by including the following details for each entry of the software asset inventory:
- Identification details (such as name, IP address, MAC address, etc.);
- The version of the software; and
- The parent resource (hardware asset or software asset) on which the software is installed.
Additional criterion
AM-04.01AC
Additional, complementingThe inventory also includes information for each entry that provides visibility into how long the software asset will receive security updates from its supplier, if such a time frame has been communicated by the supplier.
Supplementary information
This additional criterion can, but does not have to, be fulfilled by including license information, including communicated end-of-support dates related to the licensed software, for each entry of the software asset inventory.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources