# CRY-02 Cryptographic Change Management

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/cry-02/

## Basic criterion

### CRY-02.01B

When implementing changes to cryptographic systems, the cloud service provider performs an evaluation of their potential impact in accordance with DEV-06. This process includes an analysis of the cloud infrastructure of the cloud service, as well as an analysis of potential disruptions to cloud service customer-managed workloads and the evaluation of residual risks, cost implications, and integration benefits. The cloud service provider informs cloud service customers of these downstream effects to prevent unforeseen failures within the cloud service customer's specific cryptographic implementations.

**Supplementary information:**

When performing the evaluation of the potential impact of changes, the cloud service provider should consider the complexity of the distributed architecture of its cloud service.

### CRY-02.02B

All changes and adjustments to cryptographic systems are documented and traceable.

### CRY-02.03B

The personnel responsible for cryptographic systems is regularly trained and informed about respective changes.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that, if notified about any changes to cryptographic systems by the cloud service provider, they engage actively in a thorough evaluation of potential impacts on their usage of the cloud service.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.