# AM-11 Transfer of Hardware

- Domain: AM – Asset Management
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/am-11/

## Basic criterion

### AM-11.01B

Based on a risk assessment (cf. OIS-07), the cloud service provider ensures the secure and controlled transfer of hardware objects used in the cloud service production environment to an offsite or alternate location.

### AM-11.02B

The transfer of hardware is authorised by designated personnel.

**Supplementary information:**

Authorisation ensures that hardware object transfers, whether internal or external, are controlled, traceable, and compliant with organisational policies. This is particularly important for assets containing sensitive data or used in production environments. The process typically includes:

1. Verification of asset ownership and classification;
2. Assessment of associated risks;
3. Documentation of the transfer request and approval; and
4. Confirmation of secure handling during transit.

### AM-11.03B

The cloud service provider ensures that all transfers of hardware objects used in the cloud service production environment are conducted using secure, documented methods designed to prevent unauthorised access, tampering, data leakage, or loss during transit. These methods include physical protection, chain-of-custody tracking, and verification upon receipt.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.