INQ · Dealing with Investigation Requests from Government Agencies
INQ-03 Limiting Access to or Disclosure of Data in Investigation Requests
Changed since C5:2020 · formerly INQ-04
Basic criterion
Specified which data types the criterion applies to.
Otherwise, linguistic adaptation without changes in content.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
The Cloud Service Provider's procedures for setting up access to or disclosure of cloud customer data as part of an investigation requests, ensure that government agencies only have access to the data they need to investigate.
If no clear limitation of the data is possible, the Cloud Service Provider anonymises or pseudonymises the data so that government agencies can only assign it to those cloud customers who are subject of the investigation request.
Basic criterion
The cloud service provider's procedures for granting access to or disclosing cloud service customer data and cloud service derived data in the context of investigation requests from government agencies ensure that the agencies only gain access to or insight into the data that is the subject of the investigation request.
If no clear limitation of the cloud service customer data and cloud service derived data is possible, the cloud service provider anonymises or pseudonymises this data so that government agencies can only assign it to those cloud service customers who are subject of the investigation request.
Additional criterion
INQ-03.01AC
Additional, complementingThe access and activities performed by or on behalf of investigators are monitored by the cloud service provider as determined by the process described in INQ-01.
INQ-03.02AC
Additional, complementingTimely and appropriate remediation measures address any deviations identified during the monitoring of the activities performed by or on behalf of investigators.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources