# CRY-09 Secure Key Provisioning

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: changed (formerly CRY-04)
- Web page: https://c5.patrickscheid.de/en/cry-09/

## Basic criterion

### CRY-09.01B

The cloud service provider has documented and implemented procedures and technical safeguards to ensure that cryptographic keys are provisioned and activated securely within its area of responsibility. These procedures include the verification of identity and authorisation before provisioning and activating keys to ensure they are granted to legitimate entities.

### CRY-09.02B

Provisioned keys include activation and deactivation dates to ensure that their use is time limited.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Dissolved the former key management criterion and moved key provisioning into its own criterion with extended requirements.

**Additional criterion:**

Dissolved the former key management criterion and moved key provisioning into its own criterion, to which the former key management additional criterion does not apply.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.