C5 Field Guideunofficial

AM · Asset Management

AM-10 Protection of Hardware on Hold

2 sub-criteria: 1 basic, 1 additional

New in C5:2026

Basic criterion

AM-10.01B

Based on a risk assessment (cf. OIS-07), the cloud service provider has documented and implemented a procedure for protecting hardware components of the cloud service's production environment that are temporarily not in use. The procedure supports the secure storage and protection against unauthorised access or damage of inactive hardware until it is needed again.

Additional criterion

AM-10.01AS

Additional, sharpens01B

Based on a risk assessment (cf. OIS-07), the cloud service provider has documented and implemented a procedure for protecting any hardware components that are temporarily not in use. The procedure supports the secure storage and protection against unauthorised access or damage of inactive hardware until it is needed again.

Referenced in this criterion

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources