CRY · Cryptography and Key Management
CRY-05 Encryption of Sensitive Data at Rest
Changed since C5:2020 · formerly CRY-03
Basic criterion
Rephrased requirements regarding keys being only accessible by the cloud service customer (formerly: being only known by the customer).
Added requirement regarding the notification of cloud service customers in case of security relevant changes.
Added requirement regulating the use of master keys.
Additional criterion
Replaced former additional requirement with new additional requirement regarding the prevention of cloud service customer data recovery through encryption.
Wording in C5:2020
Basic criterion
The Cloud Service Provider has established procedures and technical safeguards to encrypt cloud customers' data during storage. The private keys used for encryption are known only to the cloud customer in accordance with applicable legal and regulatory obligations and requirements. Exceptions follow a specified procedure. The procedures for the use of private keys, including any exceptions, must be contractually agreed with the cloud customer.
Additional criterion
The private keys used for encryption are known to the customer exclusively and without exception in accordance with applicable legal and regulatory obligations and requirements.
Basic criterion
The cloud service provider has established procedures and technical safeguards to encrypt cloud service customer data during storage (i.e. at rest).
In general, the private keys (for asymmetric algorithms) or secret keys (for symmetric algorithms) used for encryption are accessible only by the cloud service customer in accordance with applicable legal and regulatory obligations and requirements. If due to the nature of the cloud service, the cloud service provider has to access the private or secret keys of the customer in order to provide the cloud service, this access is performed in accordance with IAM-07. Exceptions follow a specified procedure.
Supplementary information
Also applies to 03B, 04B, 01AC
The requirement of 'accessible only by the cloud service customer' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext.
This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.
Supplementary information
Scenarios in which the cloud service provider has to access the secret or private keys of the customer include, but are not limited to, the use of provider-managed keys in a SaaS service.
Supplementary information
Also applies to 05B
The use of a master key by the cloud service provider may be an exception to the requirement that keys are accessible only by the cloud service customers.
The procedures for the use of private keys, including any exceptions, are agreed with the cloud service customer.
Supplementary information
Also applies to 02B, 04B, 01AC
The requirement of 'accessible only by the cloud service customer' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext.
This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.
If any changes of these procedures and technical safeguards may affect the confidentiality of the cloud service customer data, the cloud service provider communicates these changes to the cloud service customers.
Supplementary information
Also applies to 02B, 03B, 01AC
The requirement of 'accessible only by the cloud service customer' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext.
This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.
If the cloud service provider uses a master key, the cloud service provider regularly tests the suitability of the design and operating effectiveness of the respective controls.
Supplementary information
Also applies to 02B
The use of a master key by the cloud service provider may be an exception to the requirement that keys are accessible only by the cloud service customers.
Additional criterion
CRY-05.01AC
Additional, complementingThe cloud service provider ensures that secure encryption mechanisms are in place to prevent the recovery of cloud service customer data when resources are reallocated or physical media are recovered.
Supplementary information
The requirement of 'accessible only by the cloud service customer' means that encryption keys remain solely within the knowledge and control of the owner. This can be addressed by implementing a secure key management system. If a key management system is used, the keys need to be protected from usage not explicitly authorised by the owner of the key and remain inaccessible in plaintext.
This criterion does not apply to data that cannot be encrypted for the provision of the cloud service for functional reasons.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls for those parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution), that their data is encrypted during storage in accordance with the respective protection needs.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources