# CRY-12 Cryptographic Key Transition Management

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: changed (formerly CRY-04)
- Web page: https://c5.patrickscheid.de/en/cry-12/

## Basic criterion

### CRY-12.01B

The cloud service provider has documented and implemented procedures to oversee the transition of cryptographic keys, including their movement into and out of suspension. These procedures ensure that all key transitions are thoroughly monitored, reviewed, and approved to maintain security and comply with applicable laws and regulations.

**Supplementary information:**

Suspension of a cryptographic key refers to a temporary state in which the key is disabled and cannot be used for cryptographic operations but may later be reactivated. Deactivation of a cryptographic key, in contrast, represents a permanent state in which the key is withdrawn from use and cannot be reactivated.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Dissolved the former key management criterion and moved key transition management into its own criterion with extended requirements.

**Additional criterion:**

Dissolved the former key management criterion and moved key transition management into its own criterion, to which the former key management additional criterion does not apply.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.