# Complementary customer criteria - Web page: https://c5.patrickscheid.de/en/customer-criteria/ What cloud service customers implement on their side, collected from all criteria. ## OIS – Organisation of Information Security ### OIS-03 Interfaces and Dependencies Cloud service customers ensure with suitable controls that the guidelines and requirements for compliance with the contractual agreements with the cloud service provider (i.e., responsibilities, cooperation obligations and interfaces for reporting security incidents) are adequately defined, documented and set up. - Web page: https://c5.patrickscheid.de/en/ois-03/index.html.md ## SP – Security Policies and Procedures ### SP-03 Exceptions from Existing Policies and Procedures Cloud service customers ensure with suitable controls that they obtain information from the cloud service provider about exceptions to information security policies and procedures in order to assess and appropriately manage the associated risks to their own information security. - Web page: https://c5.patrickscheid.de/en/sp-03/index.html.md ## AM – Asset Management ### AM-09 Asset Classification and Labelling Cloud service customers ensure with suitable controls that the protection need of the information that can be processed or stored with the cloud service is adequately determined. Cloud service customers ensure with suitable controls that the information processed or stored with the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with its protection needs. - Web page: https://c5.patrickscheid.de/en/am-09/index.html.md ## PS – Physical Security ### PS-02 Redundancy Model Cloud service customers ensure with suitable controls that the existing redundancy model of the cloud service provider and the evidence for the verification of the model comply with their own requirements for the availability and reliability of the cloud service. - Web page: https://c5.patrickscheid.de/en/ps-02/index.html.md ## OPS – Operations ### OPS-01 Capacity Management - Planning Cloud service customers ensure with suitable controls that the capacity and resource requirements to be covered by the cloud service provider are planned and reflected in the SLA with the cloud service provider. The requirements are reviewed regularly and the adjustment of SLA demanded accordingly. - Web page: https://c5.patrickscheid.de/en/ops-01/index.html.md ### OPS-02 Capacity Management - Monitoring Cloud service customers ensure with suitable controls that the contractual agreements made with the cloud service provider for the provision of resources or services can be monitored. In case of deviations, appropriate controls ensure that the cloud service provider is informed so that the cloud service provider can take appropriate action. - Web page: https://c5.patrickscheid.de/en/ops-02/index.html.md ### OPS-03 Capacity Management - Controlling of Resources Cloud service customers ensure with suitable controls that they manage and monitor the system resources in their area of responsibility. - Web page: https://c5.patrickscheid.de/en/ops-03/index.html.md ### OPS-05 Protection Against Malware - Implementation Cloud service customers ensure with suitable controls that the layers of the cloud service which they are responsible for have security products in place to detect and remove malware. - Web page: https://c5.patrickscheid.de/en/ops-05/index.html.md ### OPS-06 Data Backup and Recovery - Policies and Procedures Cloud service customers ensure with suitable controls that the contractual agreements made with the cloud service provider regarding the scope, frequency and duration of data retention meet business requirements. The business requirements are assessed as part of the business impact analysis (cf. BCM-02). - Web page: https://c5.patrickscheid.de/en/ops-06/index.html.md ### OPS-07 Data Backup and Recovery - Monitoring Cloud service customers ensure with suitable controls that the backup of data within their area of responsibility is monitored by technical and organisational measures. - Web page: https://c5.patrickscheid.de/en/ops-07/index.html.md ### OPS-08 Data Backup and Recovery - Regular Testing Cloud service customers ensure with suitable controls that they actively request information on the results of restore tests from the cloud service provider. Customers assess the effectiveness of applied data recovery strategies and integrate insights into their own emergency plans in alignment with their business needs and security standards. - Web page: https://c5.patrickscheid.de/en/ops-08/index.html.md ### OPS-10 Logging and Monitoring - Policies and Procedures Cloud service customers ensure with suitable controls that appropriate logging and monitoring of events that may affect the security and availability of the cloud service (e.g. administrator activities, system failures, authentication checks, data deletions, etc.) takes place for those layers of the cloud service under their responsibility. - Web page: https://c5.patrickscheid.de/en/ops-10/index.html.md ### OPS-11 Logging and Monitoring - Policies and Procedures for Handling Cloud Service Derived Data and Account Data Cloud service customers ensure with suitable controls that their contracts with the cloud service provider clearly outline the permissible uses of cloud service derived data. Cloud service customers verify that such data processing complies with contractual or legal restrictions and understand that the provider is obligated to delete data when it is no longer necessary for its initial purposes, unless agreed otherwise. - Web page: https://c5.patrickscheid.de/en/ops-11/index.html.md ### OPS-14 Logging and Monitoring - Retention of the Logging Data Cloud service customers ensure with suitable controls that they determine whether they require access to the customer-specific portion of the cloud service derived data that consists of log data, and if so, actively request it. - Web page: https://c5.patrickscheid.de/en/ops-14/index.html.md ### OPS-15 Logging and Monitoring - Accountability Cloud service customers ensure with suitable controls that unique user IDs are assigned which allow a corresponding analysis in the event of an incident. - Web page: https://c5.patrickscheid.de/en/ops-15/index.html.md ### OPS-18 Managing Vulnerabilities - Policies and Procedures Cloud service customers ensure with suitable controls that they check system components in their area of responsibility for vulnerabilities on a regular basis and mitigate these with appropriate measures. - Web page: https://c5.patrickscheid.de/en/ops-18/index.html.md ### OPS-24 Involvement of Cloud Service Customers in the Event of Incidents Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider regarding incidents that affect them, and that these notifications are forwarded in a timely manner to the department responsible for processing them so that appropriate action can be taken. - Web page: https://c5.patrickscheid.de/en/ops-24/index.html.md ### OPS-25 Managing Vulnerabilities, Incidents and Crashes - Vulnerability Scans Cloud service customers ensure with suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures. If cloud service customers operate virtual machines or containers with the cloud service, this also includes performing vulnerability scans to ensure that secure images (so-called golden images) provided by either the cloud service provider or the cloud service customer themselves are used. - Web page: https://c5.patrickscheid.de/en/ops-25/index.html.md ### OPS-26 Managing Vulnerabilities, Incidents and Crashes - System Hardening Cloud service customers ensure with suitable controls that layers of the cloud service which are under their responsibility are hardened according to generally established and accepted industry standards. The hardening specifications applied are derived from a risk assessment of the planned usage of the cloud service. - Web page: https://c5.patrickscheid.de/en/ops-26/index.html.md ### OPS-31 Separation of Datasets - Implementation Cloud service customers ensure with suitable controls that the functions provided by the cloud service for separating shared virtual and physical resources are used in such way that risks related to separation are adequately addressed according to the data's protection needs. - Web page: https://c5.patrickscheid.de/en/ops-31/index.html.md ## IAM – Identity and Access Management ### IAM-07 Access to Cloud Service Customer Data Cloud service customers ensure with suitable controls that their contracts with the cloud service provider include a comprehensive list of all instances where the provider might access customer data in an unencrypted form. Cloud service customers verify that these conditions are thoroughly documented before engaging the services, allowing them to make informed decisions about data security and compliance. Cloud service customers ensure with suitable controls that they provide a response to data access requests by the cloud service provider within a specified time frame as agreed upon in the contractual agreements. - Web page: https://c5.patrickscheid.de/en/iam-07/index.html.md ## CRY – Cryptography and Key Management ### CRY-02 Cryptographic Change Management Cloud service customers ensure with suitable controls that, if notified about any changes to cryptographic systems by the cloud service provider, they engage actively in a thorough evaluation of potential impacts on their usage of the cloud service. - Web page: https://c5.patrickscheid.de/en/cry-02/index.html.md ### CRY-04 Protection of Data for Transmission (Transport Protection) Cloud service customers ensure with suitable controls for those parts of the cloud service under their responsibility that their data is transmitted over encrypted connections in accordance with the respective protection needs. - Web page: https://c5.patrickscheid.de/en/cry-04/index.html.md ### CRY-05 Encryption of Sensitive Data at Rest Cloud service customers ensure with suitable controls for those parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution), that their data is encrypted during storage in accordance with the respective protection needs. - Web page: https://c5.patrickscheid.de/en/cry-05/index.html.md ### CRY-08 Public-Key Certificate Issuance Cloud service customers ensure with suitable controls that, where they use certificate authority services provided by the cloud service provider, identity verification procedures appropriate to the certificates being issued are implemented and the technical controls provided by the cloud service are configured to enable and enforce identity verification. Cloud service customers ensure with suitable controls that, where they obtain certificates from external Certificate Authorities for their own use, procedures are established for selecting trusted Certificate Authorities and validating the authenticity of obtained certificates. - Web page: https://c5.patrickscheid.de/en/cry-08/index.html.md ### CRY-18 Usage of External Key Management Systems Cloud service customers ensure that their own key management procedures are compatible with the requirements of the external KMS and that they implement appropriate controls to ensure the security of their keys. - Web page: https://c5.patrickscheid.de/en/cry-18/index.html.md ### CRY-19 Secure Handling of Customer Managed Keys Cloud service customers ensure with suitable controls that their agreements with the cloud service provider include robust procedures and technical safeguards for the secure handling of customer-managed cryptographic keys. Cloud service customers ensure that these procedures address the secure integration of their keys into the cloud environment, comprehensive logging of all activities related to their keys, and clearly defined access control mechanisms to restrict access solely to authorised users. - Web page: https://c5.patrickscheid.de/en/cry-19/index.html.md ## COS – Communication Security ### COS-01 Technical Safeguards Cloud service customers ensure with suitable controls for parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution) that they detect and respond to network-based attacks, based on anomalous inbound and outbound traffic patterns (e.g. MAC spoofing and ARP poisoning attacks) and/or Distributed Denial of Service (DDoS), in a timely manner. - Web page: https://c5.patrickscheid.de/en/cos-01/index.html.md ### COS-03 Monitoring of Connections in the Cloud Service Provider's Network Cloud service customers ensure with suitable controls that the virtual networks within the cloud service for which they are responsible are designed, configured and documented in accordance with their network security requirements (e.g. logical segmentation of the cloud service customer's organisational units). - Web page: https://c5.patrickscheid.de/en/cos-03/index.html.md ### COS-04 Cross-Network Access Cloud service customers ensure with suitable controls that access is controlled according to their protection needs by security gateways on the perimeters of the virtual networks within the cloud service for which they are responsible. - Web page: https://c5.patrickscheid.de/en/cos-04/index.html.md ### COS-06 Separation of Data Traffic in Jointly Used Network Environments Cloud service customers ensure with suitable controls for those parts of the cloud service under their responsibility that virtual networks are designed, configured and documented in accordance with their network security requirements (e.g. logical segmentation of organisational units). - Web page: https://c5.patrickscheid.de/en/cos-06/index.html.md ### COS-08 Policies for Data Transmission Cloud service customers ensure with suitable controls that the data transmitted to the cloud service is protected against tampering, copying, modifying, redirecting or deleting in accordance with their protection needs. - Web page: https://c5.patrickscheid.de/en/cos-08/index.html.md ## PI – Portability and Interoperability ### PI-01 Safety of Input and Output Interfaces Cloud service customers ensure with suitable controls that the interfaces provided (and their security) are adequate for its protection needs by means of appropriate checks before the start of use of the cloud service and each time the interfaces are changed. - Web page: https://c5.patrickscheid.de/en/pi-01/index.html.md ### PI-02 Contractual Agreements for the Provision of Data Cloud service customers ensure with suitable controls that the data to which they are contractually entitled is requested from the cloud service provider at the end of the contract or accessed via defined interfaces (the type and scope of the data correspond to the contractual agreements that were concluded prior to the use of the cloud service) and that it is stored in accordance with the legal requirements applicable to this data. - Web page: https://c5.patrickscheid.de/en/pi-02/index.html.md ### PI-03 Secure Deletion of Data Cloud service customers ensure with suitable controls that the legal and regulatory framework (e.g. legal requirements for storage and deletion) is identified and that the deletion of their data is initiated accordingly. - Web page: https://c5.patrickscheid.de/en/pi-03/index.html.md ## DEV – Procurement, Development and Modification of Information Systems ### DEV-07 Testing Changes Where changes are to be tested by the cloud service customers in accordance with the contractual agreements prior to deployment in the production environment, the cloud service customers ensure with suitable controls that the tests are performed appropriately to identify errors. In particular, this includes timely execution of the tests by qualified personnel in accordance with the conditions specified by the cloud service provider. - Web page: https://c5.patrickscheid.de/en/dev-07/index.html.md ### DEV-10 Approvals for Provision in the Production Environment Where changes are to be approved by the cloud service customers in accordance with the contractual agreements before they are made available in the production environment, the cloud service customers ensure with suitable controls that authorised and qualified personnel receives the information made available, assesses the impact on the ISMS framework and decides on the approval in accordance with the conditions specified by the cloud service provider. - Web page: https://c5.patrickscheid.de/en/dev-10/index.html.md ## SSO – Control and Monitoring of Service Providers and Suppliers ### SSO-05 Monitoring of Compliance with Requirements Cloud service customers ensure with suitable controls that they stay informed about subservice organisations of their cloud service provider (e.g. on the basis of the information in the C5 attestation report) and decide on the basis of their protection need of their data processed and stored in the cloud service whether further action should be taken to monitor and check these subservice organisations. - Web page: https://c5.patrickscheid.de/en/sso-05/index.html.md ## SIM – Security Incident Management ### SIM-01 Policy for Security Incident Management Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and that these notifications are forwarded in a timely manner to the responsible departments for handling so that an appropriate response can be triggered. - Web page: https://c5.patrickscheid.de/en/sim-01/index.html.md ### SIM-04 Documentation and Reporting of Security Incidents Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and their resolution and that these notifications are timely forwarded to the entity responsible for handling them so that an appropriate response can be made. - Web page: https://c5.patrickscheid.de/en/sim-04/index.html.md ### SIM-05 Duty of the Personnel to Report Security Incidents to a Central Body Cloud service customers ensure with suitable controls that identified security events, which the cloud service provider is required to process, are communicated timely to previously designated, responsible personnel. The identification of such security events is supported by suitable controls (cf. complementary criterion for OPS-10). - Web page: https://c5.patrickscheid.de/en/sim-05/index.html.md ### SIM-06 Evaluation and Learning Process Cloud service customers ensure with suitable controls that they include into their ISMS the findings and measures related to previous security incidents reported by the cloud service provider. The cloud service customers evaluate whether and which supporting measures they might take on their side. - Web page: https://c5.patrickscheid.de/en/sim-06/index.html.md ## BCM – Business Continuity Management ### BCM-02 Business Impact Analysis Cloud service customers ensure with suitable controls that the scenarios for a failure of the cloud service or the cloud service provider are sufficiently considered in the context of their business impact analysis. - Web page: https://c5.patrickscheid.de/en/bcm-02/index.html.md ### BCM-03 Business Continuity Plans Cloud service customers ensure with suitable controls that the results of their business impact analysis are sufficiently considered when planning the operational continuity and the business plan in order to provide for the effects of a failure of the cloud service or cloud service provider. Cloud service customers ensure with suitable controls that the availability of the cloud service, its recovery time according to the BCM plan and the data loss of the cloud service are consistent with their own availability requirements and tolerable data loss. - Web page: https://c5.patrickscheid.de/en/bcm-03/index.html.md ### BCM-04 Testing Business Continuity Cloud service customers ensure with suitable controls that measures to prevent the impact of a cloud service or cloud service provider outage are regularly reviewed, updated, tested and exercised. The cloud service provider is involved in the tests and exercises in accordance with the contractual agreements. Cloud service customers ensure with suitable controls that the results of the cloud service provider's BCM tests and exercises are incorporated into their own BCM and that they are fully appreciated with regard to ensuring the customer's operational continuity. In tests and exercises that involve the customer and therefore require own measures on the customer side, cloud service customers ensure that the appropriate measures for coping with the scenario are practiced and tested by means of suitable BCM controls. - Web page: https://c5.patrickscheid.de/en/bcm-04/index.html.md ## COM – Compliance ### COM-02 Policy for Planning and Conducting Audits Cloud service customers ensure with suitable controls that appropriate responses are made to outages or degradations of the cloud service through such audits. To the extent that contractually agreed information and audit rights exist, the cloud service customers ensure with suitable controls that these rights are designed and executed in accordance with their own requirements. - Web page: https://c5.patrickscheid.de/en/com-02/index.html.md ## INQ – Dealing with Investigation Requests from Government Agencies ### INQ-01 Legal Assessment of Investigation Requests Cloud service customers ensure with suitable controls that the type and scope of government agencies' investigation requests and the associated disclosure of their own data has been dealt with in their own risk management and that the use of the cloud service is only taken up or continued when this risk has been deemed acceptable. - Web page: https://c5.patrickscheid.de/en/inq-01/index.html.md ### INQ-02 Informing Cloud Service Customers about Investigation Requests Cloud service customers ensure with suitable controls that such notifications are received and assessed from a legal perspective according to their own specifications and possibilities. - Web page: https://c5.patrickscheid.de/en/inq-02/index.html.md ### INQ-04 Communication of Technical Procedures for Data Disclosure in Investigation Requests Cloud service customers ensure with suitable controls that they minimise potential disclosure of their customer data. According to the protection need of the cloud service customer data, the cloud service customers take the decision if the particular cloud service can be used or if the risk of disclosure is too high. - Web page: https://c5.patrickscheid.de/en/inq-04/index.html.md ## PSS – Product Safety and Security ### PSS-01 Guidelines and Recommendations for Cloud Service Customers Cloud service customers ensure with suitable controls that the cloud service provider's information is used to derive policies, frameworks and measures for the secure configuration and use (according to their own risk assessment) of the cloud service. Compliance with these policies, frameworks and measures is checked. Changes to the information are timely assessed for their impact on these documents and any necessary changes are implemented. - Web page: https://c5.patrickscheid.de/en/pss-01/index.html.md ### PSS-03 Informing Customers about Known Vulnerabilities Cloud service customers ensure with suitable controls that the obtained vulnerability information is incorporated timely into their own risk management, evaluated and, if necessary, taken into account in their own area of responsibility. - Web page: https://c5.patrickscheid.de/en/pss-03/index.html.md ### PSS-04 Error handling and Logging Mechanisms If the cloud service is equipped with error handling and logging mechanisms, cloud service customers must activate these and configure them according to defined requirements. The cloud service customer must incorporate his own information security management for this purpose. - Web page: https://c5.patrickscheid.de/en/pss-04/index.html.md ### PSS-05 Authentication Mechanisms Cloud service customers ensure with suitable controls that the authentication mechanisms offered by the cloud service are used in accordance with the customer's identity and authorisation management requirements. If cloud service customers operate virtual machines or containers with the cloud service, they ensure with suitable controls that the authentication mechanisms cover container-specific scenarios, such as multi-factor authentication for container hosts and registry access. - Web page: https://c5.patrickscheid.de/en/pss-05/index.html.md ### PSS-06 Session Management Cloud service customers can use appropriate controls to ensure that they are using the session management protection features of the cloud service in accordance with their own ISMS. They also set the time period after which a session becomes invalid according to their own ISMS specifications. - Web page: https://c5.patrickscheid.de/en/pss-06/index.html.md ### PSS-07 Confidentiality of Authentication Information Cloud service customers ensure with suitable controls that they use sufficiently secure passwords (cf. IAM-08) and employ the procedures provided by the cloud service provider to protect the confidentiality of the passwords according to their own assessment, and that the risks of unauthorised access associated with their own choice are borne. If cloud service customers operate virtual machines or containers with the cloud service, they ensure with suitable controls that the confidentiality of the information is also ensured for the allocation of authentication information of the virtual machines or containers. - Web page: https://c5.patrickscheid.de/en/pss-07/index.html.md ### PSS-08 Roles and Rights Framework Cloud service customers ensure with suitable controls that: 1. They actively utilise the roles and rights framework and accompanying functionalities offered by the cloud service provider; 2. The granting of permissions to users in their area of responsibility is subject to authorisation; and 3. The appropriateness of the assigned authorisations is regularly reviewed and authorisations are adjusted or withdrawn in a timely manner in the event of necessary changes (e.g. personnel resignation). - Web page: https://c5.patrickscheid.de/en/pss-08/index.html.md ### PSS-09 Authorisation Mechanisms Cloud service customers ensure with suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures. - Web page: https://c5.patrickscheid.de/en/pss-09/index.html.md ### PSS-10 Software Defined Networking Cloud service customers ensure with suitable controls that they validate the functionality of SDN features for their individual use cases before using newly introduced capabilities or modifed existing ones. - Web page: https://c5.patrickscheid.de/en/pss-10/index.html.md ### PSS-11 Images for Virtual Machines and Containers Cloud service customers ensure with suitable controls that the images of virtual machines or containers they operate with the cloud service comply with their information security management requirements and that the results of the integrity checks at startup and at runtime are processed according to these requirements. - Web page: https://c5.patrickscheid.de/en/pss-11/index.html.md ### PSS-12 Region of Data Processing and Storage Cloud service customers ensure with suitable controls that, when selecting service providers and configuring the cloud service, they are informed about the available data processing and storage partitions and, if there is a choice between different partitions, that they select those that meet their own requirements. Depending on the use case and especially when using services of a cloud service provider which is based in another country, cloud service customers take the laws of their own jurisdiction applicable to them into account when making their selection (e.g. when processing personal data; compliance with legal retention obligations for business documents, etc.). - Web page: https://c5.patrickscheid.de/en/pss-12/index.html.md --- Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.