# CRY-13 Handling of Compromised Keys

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: changed (formerly CRY-04)
- Web page: https://c5.patrickscheid.de/en/cry-13/

## Basic criterion

### CRY-13.01B

The cloud service provider manages the use of compromised cryptographic keys to ensure they are only used in controlled circumstances and solely for decryption or verification (in case of signature keys), while complying with legal and regulatory requirements.

### CRY-13.02B

The cloud service provider notifies affected cloud service customers without undue delay that their keys have been compromised and will no longer be used for encryption or signing.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Dissolved the former key management criterion and moved handling of compromised keys into its own criterion with extended requirements.

**Additional criterion:**

Additional criterion removed. Instead, the basic criterion requires that compromised keys should no longer be used (outside of controlled environments).

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.