# CRY-17 Cryptographic Key Lifecycle Management

- Domain: CRY – Cryptography and Key Management
- Since C5:2020: changed (formerly CRY-04)
- Web page: https://c5.patrickscheid.de/en/cry-17/

## Basic criterion

### CRY-17.01B

The cloud service provider has documented and implemented procedures and technical safeguards to monitor and document the lifecycle of cryptographic keys and materials.

### CRY-17.02B

For all keys except for ephemeral keys, the aforementioned safeguards ensure detailed records of each key from creation to destruction, including any status changes.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Dissolved the former key management criterion and moved key lifecycle management into its own criterion with extended requirements.

**Additional criterion:**

Dissolved the former key management criterion and moved key lifecycle management into its own criterion, to which the former key management additional criterion does not apply.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.