# AM-04 Software Asset Inventory

- Domain: AM – Asset Management
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/am-04/

## Basic criterion

### AM-04.01B

The cloud service provider maintains a comprehensive inventory of all software assets, including used software (cf. AM-02). This inventory includes information for each entry that:

1. Enables the identification of the software asset;
2. Provides visibility into which other assets use the software asset for the provision of the cloud service; and
3. Enables the cloud service provider to control the software asset, perform a risk assessment and protect its information security.

**Supplementary information:**

This basic criterion can, but does not have to, be fulfilled by including the following details for each entry of the software asset inventory:

1. Identification details (such as name, IP address, MAC address, etc.);
2. The version of the software; and
3. The parent resource (hardware asset or software asset) on which the software is installed.

## Additional criterion

### AM-04.01AC (additional, complementing)

The inventory also includes information for each entry that provides visibility into how long the software asset will receive security updates from its supplier, if such a time frame has been communicated by the supplier.

**Supplementary information:**

This additional criterion can, but does not have to, be fulfilled by including license information, including communicated end-of-support dates related to the licensed software, for each entry of the software asset inventory.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.