# CRY-03 Review of Cryptography Practices

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/cry-03/

## Basic criterion

### CRY-03.01B

The cloud service provider ensures that encryption, authentication and key management practices are regularly audited in accordance with COM-02 and COM-03 to identify and address potential vulnerabilities. At a minimum, reviews are performed annually and immediately following security incidents involving cryptographic components.

**Supplementary information:**

Further criteria for key management are found in criteria CRY-06, CRY-07, CRY-09 - CRY-19

### CRY-03.02B

As part of the reviews, the cloud service provider determines if the cryptographic practices align with the state of the art and updates them as needed.

**Supplementary information:**

The cloud service provider applies the cryptographic change management process (cf. CRY-02) when updating the cryptographic practices to align with the state of the art.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.