AM-09 Asset Classification and Labelling
Changed since C5:2020 · formerly AM-06
Basic criterion
Specified which data types the criterion applies to.
Added requirement regarding the review of classification levels.
Added requirement regarding the alignment of protection objectives with delivery and recovery objectives.
Additional criterion
Added additional requirement regarding physical devices being used for connection authentication.
Added additional requirement regarding device identifaction being integrated into labeling.
Removed requirement regarding the precedence of of events affecting assets with a higher level of protection.
Wording in C5:2020
Basic criterion
Assets are classified and, if possible, labelled. Classification and labelling of an asset reflects the protection needs of the information it processes, stores, or transmits.
The need for protection is determined by the individuals or groups responsible for the assets of the Cloud Service Provider according to a uniform schema. The schema provides levels of protection for the confidentiality, integrity, availability, and authenticity protection objectives.
Additional criterion
Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority. Actions for events on assets with a higher level of protection take precedence over events on assets with a lower need for protection.
Basic criterion
Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits.
Classification levels are reviewed at least annually and in case of significant changes to the cloud service. Based on the review, the classification levels are updated where appropriate.
Supplementary information
Supplementary information
If a review is caused by significant changes to the cloud service, only the classification levels affected by the changes need to be included in the review.
The protection need is determined by the individuals or groups responsible for the assets of the cloud service provider according to a uniform and documented classification schema.
The classification schema provides levels of protection for the confidentiality, integrity, availability, and authenticity protection objectives. These protection objectives are aligned with delivery and recovery objectives set out in business and disaster recovery plans.
Additional criterion
AM-09.01AC
Additional, complementingThe unique identification of physical devices serves as an additional method for connection authentication.
Supplementary information
To ensure that all physical assets are uniquely identified, the cloud service provider may implement practices such as:
- Use of a centralised device management platform to monitor and control all devices;
- Assigning unique identifiers (e.g. MAC addresses, serial numbers) to all devices; and
- Use of automated mechanisms to register connecting devices.
AM-09.02AC
Additional, complementingDevice identification is integrated into the asset classification and labeling processes.
Supplementary information
Integrating device identification ensures that each asset is uniquely recognised and appropriately classified based on its protection needs. This is particularly important for mobile and endpoint devices, which may carry sensitive data or serve as access points to cloud services. Proper labeling supports traceability, risk assessment, and enforcement of security controls throughout the asset lifecycle.
AM-09.03AC
Additional, complementingLogging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.
AM-09.04AC
Additional, complementingActions for events on assets with a higher level of protection take precedence over events on assets with a lower protection need.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the protection need of the information that can be processed or stored with the cloud service is adequately determined.
Cloud service customers ensure with suitable controls that the information processed or stored with the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with its protection needs.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources