# CRY-10 Secure Storage of Keys

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: changed (formerly CRY-04)
- Web page: https://c5.patrickscheid.de/en/cry-10/

## Basic criterion

### CRY-10.01B

The cloud service provider has documented and implemented technical safeguards for the secure storage of cryptographic keys. This includes ensuring separation of the key management system from the application and middleware layers, defining how authorised users gain access and addressing the geographic residency of keys to comply with contractual, legal, regulatory, and security requirements.

## Additional criterion

### CRY-10.01AC (additional, complementing)

Based on a risk assessment (cf. OIS-07), the cloud service provider uses a suitable software or hardware security module for the secure storage of cryptographic keys.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Dissolved the former key management criterion and moved key storage into its own criterion with extended requirements.

**Additional criterion:**

Dissolved the former key management criterion and moved key provisioning into its own criterion, to which the former key management additional criterion does not apply.

Added new additional criterion instead.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.