CRY · Cryptography and Key Management
CRY-13 Handling of Compromised Keys
Changed since C5:2020 · formerly CRY-04
Basic criterion
Dissolved the former key management criterion and moved handling of compromised keys into its own criterion with extended requirements.
Additional criterion
Additional criterion removed. Instead, the basic criterion requires that compromised keys should no longer be used (outside of controlled environments).
Wording in C5:2020
Basic criterion
Procedures and technical safeguards for secure key management in the area of responsibility of the Cloud Service Provider include at least the following aspects:
- Generation of keys for different cryptographic systems and applications;
- Issuing and obtaining public-key certificates;
- Provisioning and activation of the keys;
- Secure storage of keys (separation of key management system from application and middleware level) including description of how authorised users get access;
- Changing or updating cryptographic keys including policies defining under which conditions and in which manner the changes and/or updates are to be realised;
- Handling of compromised keys;
- Withdrawal and deletion of keys; and
- If pre-shared keys are used, the specific provisions relating to the safe use of this procedure are specified separately.
Additional criterion
Keys should be withdrawn or deleted e.g. in the event of compromise or employee changes. The Cloud Service Provider protects the keys which are created and inserted into the cloud service by the cloud customers according to the same criteria as the keys created by the Cloud Service Provider.
Basic criterion
The cloud service provider manages the use of compromised cryptographic keys to ensure they are only used in controlled circumstances and solely for decryption or verification (in case of signature keys), while complying with legal and regulatory requirements.
The cloud service provider notifies affected cloud service customers without undue delay that their keys have been compromised and will no longer be used for encryption or signing.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources