# AM-07 Decommissioning of Hardware

- Domain: AM – Asset Management
- Since C5:2020: changed (formerly AM-04)
- Web page: https://c5.patrickscheid.de/en/am-07/

**Supplementary information:**

This criterion is not applicable for hardware components that do not store cloud service customer data, cloud service derived data, cloud service provider data or account data (e.g. monitors, routers or keyboards).

## Basic criterion

### AM-07.01B

The cloud service provider defines, documents and implements a procedure for the decommissioning of hardware used to operate system components supporting the cloud service production environment under the responsibility of the cloud service provider. As part of this procedure, approval by authorised personnel of the cloud service provider based on the applicable policies is required.

**Supplementary information:**

The decommissioning procedure typically includes:

1. Verification that the asset is no longer required for operational use;
2. Assessment of associated risks and dependencies;
3. Approval by authorised personnel based on internal policies;
4. Execution of secure data deletion or sanitization processes;
5. Updating the asset inventory to reflect decommissioning status; and
6. Disposal or repurposing of the hardware in accordance with environmental and security guidelines.

### AM-07.02B

The decommissioning includes either:

1. The complete and permanent deletion of all cloud service customer data, cloud service derived data, cloud service provider data and account data; or
2. The proper destruction of the media.

Account data needs to be deleted at least in cases where the data is located in the production environment for the operation of system components.

**Supplementary information (on 02B, 01AC):**

The deletion of data or physical destruction of data mediums can take place, for example, according to DIN 66399 or BSI IT-Grundschutz module CON.6.

## Additional criterion

### AM-07.01AS (additional, sharpens 01B)

The cloud service provider defines, documents and implements a procedure for the decommissioning of hardware used to operate system components supporting the cloud service production, development, test or staging environment under the responsibility of the cloud service provider. As part of this procedure, approval by authorised personnel of the cloud service provider based on the applicable policies is required.

### AM-07.01AC (additional, complementing)

The destruction of data on hardware components is carried out in such a manner that data recovery can be reasonably considered to be impossible.

**Supplementary information:**

This approval process ensures that disposal activities conducted offsite adhere to the organisation's security, compliance, and environmental policies. It typically includes:

1. Verification of asset ownership and usage history;
2. Assessment of data sanitisation requirements;
3. Selection of approved disposal vendors or methods;
4. Documentation of disposal actions and approvals; and
5. Confirmation of secure data deletion or destruction.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Slight linguistic adaptations, and restructured options for decommissioning as a list.

Further specified application of the criterion to account data.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.