# AM-09 Asset Classification and Labelling

- Domain: AM – Asset Management
- Since C5:2020: changed (formerly AM-06)
- Web page: https://c5.patrickscheid.de/en/am-09/

## Basic criterion

### AM-09.01B

Assets are classified and, if possible, labelled. Classification and labelling of an asset reflect the protection needs of the category of cloud service customer data, cloud service derived data, cloud service provider data and account data it processes, stores, or transmits.

**Supplementary information (on 01B, 02B, 03B, 04B):**

If the cloud service provider does not categorise the assets specifically, then all assets may be treated as requiring the highest level of protection needs.

### AM-09.02B

Classification levels are reviewed at least annually and in case of significant changes to the cloud service. Based on the review, the classification levels are updated where appropriate.

**Supplementary information:**

If a review is caused by significant changes to the cloud service, only the classification levels affected by the changes need to be included in the review.

### AM-09.03B

The protection need is determined by the individuals or groups responsible for the assets of the cloud service provider according to a uniform and documented classification schema.

### AM-09.04B

The classification schema provides levels of protection for the confidentiality, integrity, availability, and authenticity protection objectives. These protection objectives are aligned with delivery and recovery objectives set out in business and disaster recovery plans.

## Additional criterion

### AM-09.01AC (additional, complementing)

The unique identification of physical devices serves as an additional method for connection authentication.

**Supplementary information:**

To ensure that all physical assets are uniquely identified, the cloud service provider may implement practices such as:

1. Use of a centralised device management platform to monitor and control all devices;
2. Assigning unique identifiers (e.g. MAC addresses, serial numbers) to all devices; and
3. Use of automated mechanisms to register connecting devices.

### AM-09.02AC (additional, complementing)

Device identification is integrated into the asset classification and labeling processes.

**Supplementary information:**

Integrating device identification ensures that each asset is uniquely recognised and appropriately classified based on its protection needs. This is particularly important for mobile and endpoint devices, which may carry sensitive data or serve as access points to cloud services. Proper labeling supports traceability, risk assessment, and enforcement of security controls throughout the asset lifecycle.

### AM-09.03AC (additional, complementing)

Logging and monitoring applications take the asset protection needs into account in order to inform the responsible stakeholder of events that could lead to a violation of the protection goals, so that the necessary measures are taken with an appropriate priority.

### AM-09.04AC (additional, complementing)

Actions for events on assets with a higher level of protection take precedence over events on assets with a lower protection need.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the protection need of the information that can be processed or stored with the cloud service is adequately determined.

Cloud service customers ensure with suitable controls that the information processed or stored with the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with its protection needs.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Added requirement regarding the review of classification levels.

Added requirement regarding the alignment of protection objectives with delivery and recovery objectives.

**Additional criterion:**

Added additional requirement regarding physical devices being used for connection authentication.

Added additional requirement regarding device identifaction being integrated into labeling.

Removed requirement regarding the precedence of of events affecting assets with a higher level of protection.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.