AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets
Changed since C5:2020 · formerly AM-05
Basic criterion
Slight linguistic adaptations.
Added requirements regarding assets that cannot be returned prior to or on the day of the termination of employment.
Additional criterion
Additional criterion removed. Managed endpoints are instead addressed by the additional criterion of AM-12.
Wording in C5:2020
Basic criterion
The Cloud Service Provider's internal and external employees are provably committed to the policies and instructions for acceptable use and safe handling of assets before they can be used if the Cloud Service Provider has determined in a risk assessment that loss or unauthorised access could compromise the information security of the Cloud Service.
Any assets handed over are provably returned upon termination of employment.
Additional criterion
Physical assets of internal and external employees are managed centrally.
Central management enables software, data, and policy distribution, as well as remote deactivation, deletion, or locking.
Supplementary information on all sub-criteria
The criterion essentially concerns mobile devices (e.g. notebooks, tablets, smartphones, FIDO2 security keys, etc.), especially if confidential information is stored on them that can be used, in the event of unauthorised access, to obtain privileged access to the cloud service (e.g. if these are used as security tokens for authentication).
Basic criterion
The cloud service provider determines in a risk assessment (cf. OIS-07) if loss of or unauthorised access to assets could compromise the information security of the cloud service. If so, the cloud service provider's internal and external personnel is provably committed to the policies and procedures for proper use and safe and secure handling of assets before they can be used.
Any assets handed over are provably returned upon termination of employment.
If assets cannot be returned prior to or on the day of the termination, the cloud service provider removes the access rights of the personnel no later than the date of termination
Supplementary information
The removal of access rights of terminated personnel can be implemented by e.g. disabling their identity on the device.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources