# CRY-11 Cryptographic Key Archival

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/cry-11/

## Basic criterion

### CRY-11.01B

The cloud service provider has documented and implemented procedures and technical safeguards for the secure archiving of cryptographic keys. These include:

1. Storage of archived keys in a repository to prevent unauthorised access;
2. Restriction of access to archived keys to authorised personnel based on the principle of least privilege;
3. Support of later recovery of information through archived keys;
4. Retention of archived keys only for as long as needed and secure destruction afterwards; and
5. Logging of all activities related to the storage and recovery of archived keys.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.