# INQ-04 Communication of Technical Procedures for Data Disclosure in Investigation Requests

- Domain: INQ – Dealing with Investigation Requests from Government Agencies
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/inq-04/

**Supplementary information:**

The criterion is limited to cloud service customer data. The cloud service provider typically has access to other data types such as cloud service derived data and account data such that extending the criterion to those other data types, may not lead to useful information for customers' risk management. Technical capabilities and limitations to access cloud service customer data include aspects such as:

1. If the cloud service customers store their cloud service customer data in unencrypted form;
2. If the cloud service provider encrypts cloud service customer data in storage and transit;
3. Whether the cloud service provider has the ability to decrypt cloud service customer data in case of such requests and how this ability for access or disclosure is used;
4. Retention periods for cloud service derived data relating to the cloud service customer and whether such data is stored in encrypted form;
5. Possibilities for decrypting cloud service customer data or for extracting cloud service customer data during the decryption process;
6. Disclosure of user identities and credentials; and
7. Further measures that have been created or can be used for disclosing cloud service customer data.

## Basic criterion

### INQ-04.01B

The cloud service provider documents the technical procedures per service and other technical information regarding the provision or disclosure of cloud service customer data in response to valid investigation requests and provides it to cloud service customers.

### INQ-04.02B

The type and scope of the information provided to the cloud service customers is based on the needs of their expert personnel to assess risks to the cloud service customer's data confidentiality. At a minimum, the following aspects are addressed:

1. The process for the provision and disclosure of cloud service customer data in response to legitimate investigation requests;
2. The technical capabilities and limitations of the cloud service provider regarding disclosure of cloud service customer data;
3. Logging mechanisms implemented to records access for disclosure of cloud service customer data;
4. Access possibilities for cloud service customers to review such logs;
5. Methods and technical procedures per service for accessing and disclosing cloud service customer data; and
6. Laws, regulations, or other legal means and their applicability concerning the cloud service provider's ability to inform its customers about the provision and disclosure of cloud service customer data.

### INQ-04.03B

The aforementioned document is maintained in accordance with SP-01 and aligned with the cloud service provider's guidelines on minimising access to cloud service customer data (cf. DEV-01) to ensure its relevance and accuracy for cloud service customers.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they minimise potential disclosure of their customer data. According to the protection need of the cloud service customer data, the cloud service customers take the decision if the particular cloud service can be used or if the risk of disclosure is too high.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.