AM-06 Commissioning of Hardware
Changed since C5:2020 · formerly AM-03
Basic criterion
Linguistic adaptation without changes in content.
Wording in C5:2020
Basic criterion
The Cloud Service Provider has an approval process for the use of hardware to be commissioned, which is used to provide the cloud service in the production environment, in which the risks arising from the commissioning are identified, analysed and mitigated. Approval is granted after verification of the secure configuration of the mechanisms for error handling, logging, encryption, authentication and authorisation according to the intended use and based on the applicable policies.
Supplementary information on all sub-criteria
The criterion applies only to physical hardware objects, such as servers, storage systems, and network components.
Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV).
The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.
Basic criterion
The cloud service provider has implemented an approval process for commissioning hardware used to provide the cloud service in the production environment. This process involves identifying, analysing, and mitigating any risks (cf. OIS-07) associated with the commissioning.
Approval is granted after verification of the secure configuration of the mechanisms for error handling, logging, encryption, authentication and authorisation according to the intended use and based on the applicable policies.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources