C5 (Germany)
C5: Asset Management

C5 (Germany) C5-AM-02: Acceptable Use and Safe Handling of Assets Policy

Document, communicate and issue acceptable use and safe handling instructions spanning approval for acquisition through disposal, classification and labelling, secure configuration, software versions and patching, unsupported software, installation restrictions, malware protection, remote wipe, physical transport, incident handling and irreversible deletion at decommissioning.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 80 controls across 27 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 6 controls

  • CCM-DCS-02 Off-Site Transfer Authorization Policy and Procedures
  • CCM-DCS-04 Secure Media Transportation Policy and Procedures
  • CCM-DSP-01 Security and Privacy Policy and Procedures
  • CCM-HRS-02 Acceptable Use of Technology Policy and Procedures
  • CCM-HRS-03 Clean Desk Policy and Procedures
  • CCM-UEM-01 Endpoint Devices Policy and Procedures

FedRAMP High · 6 controls

  • AC-19 Access Control for Mobile Devices
  • CM-6 Configuration Settings
  • MP-1 Policy and Procedures
  • MP-2 Media Access
  • MP-5 Media Transport
  • PL-4 Rules of Behavior

FedRAMP Moderate · 6 controls

  • AC-19 Access Control for Mobile Devices
  • CM-6 Configuration Settings
  • MP-1 Policy and Procedures
  • MP-2 Media Access
  • MP-5 Media Transport
  • PL-4 Rules of Behavior

NIST SP 800-161 Rev 1 · 6 controls

NIST SP 800-53 Rev 5 · 6 controls

ISO 27701:2019 · 5 controls

  • 6.3.2 Mobile devices and teleworking
  • 6.5.1 Responsibility for assets
  • 6.5.3 Media handling
  • 6.9.5 Control of operational software
  • 6.9.6 Technical vulnerability management

NIST SP 800-171 Rev 3 · 5 controls

CMMC 2.0 · 4 controls

ISO 27001:2022 · 4 controls

  • 5.10 Acceptable use of information and other associated assets
  • 7.10 Storage media
  • 7.7 Clear desk and clear screen
  • 8.1 User end point devices

ISO 27002:2022 · 4 controls

  • 5.10 Acceptable use of information and other associated assets
  • 7.10 Storage media
  • 7.7 Clear desk and clear screen
  • 8.1 User endpoint devices

PCI DSS 4.0 · 4 controls

  • 12.2.1 12.2.1 Rules for acceptable use of end-user technology
  • 12.6.3.2 12.6.3.2 Awareness training covers acceptable use of end-user technologies
  • 9.4.1 9.4.1 Physical security of all media
  • 9.4.3 9.4.3 Securing media sent outside the facility

UK Cyber Essentials · 4 controls

  • CE-FW.6 Host-Based Firewall for Remote Workers
  • CE-SC.9 Device Unlocking Credentials and Brute-Force Protection
  • CE-SCOPE.3 BYOD and Home Working
  • CE-SU.1 Software Licensed and Supported

CIS Controls v8 · 2 controls

  • CIS-14.4 Train Workforce on Data Handling Best Practices
  • CIS-3.1 Establish and Maintain a Data Management Process

HIPAA Security Rule · 2 controls

NIST Cybersecurity Framework 2.0 · 2 controls

  • NIST-CSF-GV.PO-01 Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
  • NIST-CSF-PR.PS-05 Installation and execution of unauthorized software are prevented

NIST SP 800-66 Rev 2 · 2 controls

SOC 2 · 2 controls

  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)
  • SOC2-CC6.7 CC6.7 Restricting and protecting information in transmission, movement and removal

ACSC Essential Eight · 1 control

  • E8-APP-ML1 Application Control (ML1)

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-15 Protect Against Threats Related to Removable Media

APEC Cross-Border Privacy Rules (CBPR) System · 1 control

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-13 Control removable storage media (Very Good)

AWS Well-Architected Security Pillar · 1 control

  • SEC07-BP02 Apply data protection controls based on data sensitivity

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-6 Information security training and awareness program

Azure Security Benchmark · 1 control

  • AM-2 Use only approved services

GDPR · 1 control

  • GDPR-Art.29 Processing under the authority of the controller or processor

NIS2 Directive · 1 control

  • Art.21.2.g Basic cyber hygiene practices and cybersecurity training

NIST SP 800-218 · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in C5: Asset Management

You are reading one control. How much of C5 (Germany) have you already done?

C5 (Germany) C5-AM-02 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of C5 (Germany) your existing evidence covers. Hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 and 95 of 121 C5 (Germany) controls already carry evidence.

If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.178.5% covered · 26 gapsIf you hold NIST SP 800-53 Rev 572.7% covered · 33 gapsIf you hold FedRAMP Moderate71.1% covered · 35 gapsIf you hold ISO 27002:202267.8% covered · 39 gapsIf you hold ISO 27001:202257% covered · 52 gapsIf you hold NIST SP 800-171 Rev 350.4% covered · 60 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 80 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll C5 (Germany) controls