AM-05 Policy for the Proper and Secure Use of Assets
Changed since C5:2020 · formerly AM-02
Basic criterion
Specified which data types the criterion applies to.
Removed inventory from the aspects to be addressed by the policies and instructions, and instead added secure handling and usage of removable media.
Modify requirement that complete and irrecoverable deletion is to be addressed by the policies and instructions to requiring that the deletion is adressed.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
Policies and instructions for acceptable use and safe handling of assets are documented, communicated and provided in accordance with SP-01 and address the following aspects of the asset lifecycle as applicable to the asset:
- Approval procedures for acquisition, commissioning, maintenance, decommissioning, and disposal by authorised personnel or system components;
- Inventory;
- Classification and labelling based on the need for protection of the information and measures for the level of protection identified;
- Secure configuration of mechanisms for error handling, logging, encryption, authentication and authorisation;
- Requirements for versions of software and images as well as application of patches;
- Handling of software for which support and security patches are not available anymore;
- Restriction of software installations or use of services;
- Protection against malware;
- Remote deactivation, deletion or blocking;
- Physical delivery and transport;
- dealing with incidents and vulnerabilities; and
- Complete and irrevocable deletion of the data upon decommissioning.
Basic criterion
Policies and procedures for the proper and secure use of assets are documented, communicated and provided in accordance with SP-01 and address the following aspects of the asset lifecycle as applicable to the asset:
- Approval procedures for acquisition, commissioning, maintenance, decommissioning, and disposal by authorised personnel or system components;
- Classification and labelling based on the protection need of the cloud service customer data, cloud service derived data, cloud service provider data and account data as well as measures for the level of protection identified;
- Secure configuration of mechanisms for error handling, logging, encryption, authentication and authorisation;
- Requirements for versions of software and images as well as application of patches;
- Handling of software for which support and security patches are not available anymore;
- Restriction of software installations or use of services;
- Protection against malware;
- Remote deactivation, deletion or blocking;
- Physical delivery and transport;
- Dealing with incidents and vulnerabilities;
- Deletion of cloud service customer data, cloud service derived data, cloud service provider data and account data; and
- Secure handling and usage of removable media, e.g. by specifying which devices are permitted to interact with removable media and what data can be stored on them or by banning the reuse of removable media.
The applicability of these aspects is defined based on the cloud service provider's asset management framework (cf. AM-01).
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources