# CRY-04 Protection of Data for Transmission (Transport Protection)

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: changed (formerly CRY-02)
- Web page: https://c5.patrickscheid.de/en/cry-04/

**Supplementary information:**

When transmitting data with normal protection needs within the cloud service provider's infrastructure, encryption is not mandatory provided that the data is not transmitted via public networks. In this case, the non-public environment of the cloud service provider can generally be deemed trusted. Configuration of the TLS protocol should comply with the recommendations of the (current) version of the BSI Technical Guideline TR-02102-2 'Cryptographic Procedures: Recommendations and key lengths. Part 2 - Use of Transport Layer Security (TLS)'. Cipher Suites should provide Perfect Forward Secrecy. Generally, wildcard certificates should not be used.

## Basic criterion

### CRY-04.01B

The cloud service provider has established procedures and technical safeguards for state of the art encryption and authentication for the transmission of cloud service customer data and cloud service derived data over public networks.

### CRY-04.02B

During remote access to the production environment, the cloud service provider uses state of the art cryptographic mechanisms, including personnel authentication, to protect the communication.

## Additional criterion

### CRY-04.01AS (additional, sharpens 01B)

The cloud service provider has established procedures and technical safeguards for state of the art encryption and authentication for the transmission of all data.

## Complementary customer criteria

Cloud service customers ensure with suitable controls for those parts of the cloud service under their responsibility that their data is transmitted over encrypted connections in accordance with the respective protection needs.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Replaced requirement for strong encryption and authentication with requirement for state of the art encryption and authentication.

Added requirement regarding the protection of remote access communication.

**Additional criterion:**

Replaced requirement for strong encryption and authentication with requirement for state of the art encryption and authentication.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.