# BSI C5 CRY-03 — Encryption of sensitive data for storage

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_bsic5_cry03_9ca5de68e9-bsi-c5-cry-03-encryption-of-sensitive-data-for-storage
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [BSI C5 (German Cloud)](https://support.icompaas.com/support/solutions/c_gen_bsi_c5) › [Cryptography & Key Management](https://support.icompaas.com/support/solutions/folders/f_gen_cgenbsic5_cryptographykeymanagement)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

BSI C5 · Control CRY-03 · Priority: critical · Component: Cryptography & Key Management

### What this control covers

Encrypts stored customer data with private keys known only to customers, per legal requirements. Specifies exceptions via contractual agreements, ensuring confidentiality of cloud customer data at rest through robust encryption procedures.

### Why it matters

Encryption and key management make data unreadable to attackers and unintelligible under data-breach safe-harbour clauses — a meaningful regulatory benefit.

### How to implement

#### AWS

Default to **SSE-KMS** with customer-managed keys for S3/EBS/RDS/Secrets Manager. Use **S3 Bucket Keys** and **S3 Block Public Access** at the account level, and turn on **S3 Object Lock** on backup buckets for ransomware resilience.

#### Azure

Store secrets in **Key Vault** (HSM-backed where required) with soft-delete + purge protection; use **customer-managed keys** for Storage, SQL, and Azure Disk Encryption. Tag PII data via **Microsoft Purview**.

#### GCP

Use **Cloud KMS** with customer-managed encryption keys (CMEK) for BigQuery, GCS, and Compute. **Sensitive Data Protection** (DLP API) inspects/de-identifies PII at scale.

#### Google Workspace

Enable **client-side encryption** for Drive/Docs and turn on **Drive Labels + DLP** rules to prevent external sharing of regulated data classes.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Encryption of sensitive data for storage.

### Quick checklist

-   Exceptions — Agreements / Protection
-   Security — Agreements / Protection
-   Confidentiality — Agreements / Protection
-   Protection — Agreements / Protection
-   Data — Agreements / Protection
-   Encryption — Agreements / Protection

### Related articles on this site

-   [Enable Transparent Data Encryption with Customer-Managed Keys on Azure SQL Servers for Enhanced Data Security](https://support.icompaas.com/support/solutions/articles/62000234802-enable-transparent-data-encryption-with-customer-managed-keys-on-azure-sql-servers-for-enhanced-data-)
-   [Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.](https://support.icompaas.com/support/solutions/articles/62000233406-ensure-that-encryption-at-rest-is-enabled-for-amazon-athena-query-results-stored-in-amazon-s3-in-orde)
-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [Ensure Customer-Managed Keys Are Used to Encrypt AWS Fargate Ephemeral Storage Data for Amazon ECS (Automated)](https://support.icompaas.com/support/solutions/articles/62000234133-ensure-customer-managed-keys-are-used-to-encrypt-aws-fargate-ephemeral-storage-data-for-amazon-ecs-a)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.