# INQ-01 Legal Assessment of Investigation Requests

- Domain: INQ – Dealing with Investigation Requests from Government Agencies
- Since C5:2020: changed (formerly INQ-01, INQ-03)
- Web page: https://c5.patrickscheid.de/en/inq-01/

## Basic criterion

### INQ-01.01B

Investigation requests from government agencies for cloud service customer data, cloud service derived data and account data are subject to a documented legal assessment by subject matter experts of the cloud service provider. The assessment determines whether the government agency has an applicable and legally valid legal basis and what further steps need to be taken for the given request.

**Supplementary information:**

For evidence purposes, all requests that were completely processed during the specified period shall form the population for testing the operating effectiveness of controls to meet the criteria in this domain. All requests are to be included in the population, irrespective of whether they resulted in cloud service customer data or cloud service derived data being disclosed.

### INQ-01.02B

Access to or disclosure of cloud service customer data, cloud service derived data or account data in response to government investigation requests is only permitted if the cloud service provider has performed a legal assessment. This assessment has to confirm that there is an applicable and valid legal basis and that the request must be granted according to this basis.

**Supplementary information:**

Disclosure of cloud service customer data to government agencies may include handing over encryption keys. The disclosure of keys should also be scrutinised in accordance with the INQ criteria. In particular, with reference to INQ-03, care should be taken to ensure that no other cloud service customer data is compromised by handing over a key.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the type and scope of government agencies' investigation requests and the associated disclosure of their own data has been dealt with in their own risk management and that the use of the cloud service is only taken up or continued when this risk has been deemed acceptable.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Merged the former INQ-01 and INQ-03 into one criterion.

Specified which data types the criterion applies to.

Otherwise, linguistic adaptation without changes in content.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.