# AM-06 Commissioning of Hardware

- Domain: AM – Asset Management
- Since C5:2020: changed (formerly AM-03)
- Web page: https://c5.patrickscheid.de/en/am-06/

**Supplementary information:**

The criterion applies only to physical hardware objects, such as servers, storage systems, and network components.

Virtual hardware and software objects are considered in the criteria areas (OPS) and (DEV).

The approval process typically considers both the basic approval to use the hardware and the final approval of the configured assets.

## Basic criterion

### AM-06.01B

The cloud service provider has implemented an approval process for commissioning hardware used to provide the cloud service in the production environment. This process involves identifying, analysing, and mitigating any risks (cf. OIS-07) associated with the commissioning.

### AM-06.02B

Approval is granted after verification of the secure configuration of the mechanisms for error handling, logging, encryption, authentication and authorisation according to the intended use and based on the applicable policies.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Linguistic adaptation without changes in content.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.