# AM-05 Policy for the Proper and Secure Use of Assets

- Domain: AM – Asset Management
- Since C5:2020: changed (formerly AM-02)
- Web page: https://c5.patrickscheid.de/en/am-05/

## Basic criterion

### AM-05.01B

Policies and procedures for the proper and secure use of assets are documented, communicated and provided in accordance with SP-01 and address the following aspects of the asset lifecycle as applicable to the asset:

1. Approval procedures for acquisition, commissioning, maintenance, decommissioning, and disposal by authorised personnel or system components;
2. Classification and labelling based on the protection need of the cloud service customer data, cloud service derived data, cloud service provider data and account data as well as measures for the level of protection identified;
3. Secure configuration of mechanisms for error handling, logging, encryption, authentication and authorisation;
4. Requirements for versions of software and images as well as application of patches;
5. Handling of software for which support and security patches are not available anymore;
6. Restriction of software installations or use of services;
7. Protection against malware;
8. Remote deactivation, deletion or blocking;
9. Physical delivery and transport;
10. Dealing with incidents and vulnerabilities;
11. Deletion of cloud service customer data, cloud service derived data, cloud service provider data and account data; and
12. Secure handling and usage of removable media, e.g. by specifying which devices are permitted to interact with removable media and what data can be stored on them or by banning the reuse of removable media.

### AM-05.02B

The applicability of these aspects is defined based on the cloud service provider's asset management framework (cf. AM-01).

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Removed inventory from the aspects to be addressed by the policies and instructions, and instead added secure handling and usage of removable media.

Modify requirement that complete and irrecoverable deletion is to be addressed by the policies and instructions to requiring that the deletion is adressed.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.