BSI C5:2020·Criterion AM-02·high·Component: Asset Management

What this control requires

Documents policies per SP-01 for asset lifecycle management, covering acquisition, maintenance, decommissioning, classification, secure configuration, malware protection, and data deletion. Ensures safe handling to prevent unauthorized access or compromise of cloud customer data.
— BSI C5:2020, Criterion AM-02

In plain English

Documents policies per SP-01 for asset lifecycle management, covering acquisition, maintenance, decommissioning, classification, secure configuration, malware protection, and data deletion. In practice, this means you can prove you risk management policy-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Asset Management, the assessor will trace your implementation back to the catalogue reference (Criterion AM-02) and look for objective evidence on the latest two assessment cycles.

How to implement

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Configuration Management

Policy-as-code. Codify the control as Service Control Policies (AWS), Azure Policy initiatives, or Organisation Policy (GCP) so the platform enforces what the document promises.

IaC. Gate Terraform / Pulumi / CloudFormation changes with Checkov / tfsec / OPA so misconfigurations never reach production.

Drift. Run a CSPM (Wiz / Prisma / Defender for Cloud / Security Command Center) over every account and route findings to a single risk register.

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

  • Risk. Document the trigger, the owner and the cadence.
  • Asset. Document the trigger, the owner and the cadence.
  • Acceptable Use. Document the trigger, the owner and the cadence.
  • Protection. Document the trigger, the owner and the cadence.
  • Data. Document the trigger, the owner and the cadence.
  • Scope: management policy, protection, - configuration, cloud customer data.

Evidence to collect

  • Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Acceptable Use and Safe Handling of Assets Policy.

Common pitfalls

  • Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.
  • Manual cloud-console changes that never make it back to Terraform — drift accumulates until the next outage forces a reconciliation.
  • Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

Related controls in BSI C5:2020

References

Topics: governance riskcloud postureconfiguration managementpolicy management