GC-03 Information on recovery parameters in emergency operation
Condition
Upon request by subject matter experts of the cloud service customers, the cloud service provider shares comprehensible and transparent information about the following recovery parameters of the cloud service:
- Maximum tolerable period of downtime (MTPD) and Recovery Time Objective (RTO);
- Maximum allowable data loss / Recovery Point Objective (RPO);
- Recovery time to start emergency operation;
- Minimum business continuity objective (MBCO) (capacity related to regular operation); and
- Restore time until normal operation.
The information enables cloud service customers to evaluate the cloud service as part of their own business impact analysis.
The description of the cloud service provider's system of internal control relevant to the development and operation of the cloud service indicates where this information can be found. References relate precisely to the individual aspects specified above, allowing these subject matter experts to find the information in a timely manner.
If information on availability and remediation of disruptions represent average values that are not binding in individual cases, this is highlighted separately.
Hint
In addition to the reference in the description of the cloud service provider, the information itself may also be an optional part of the report, e.g. in a section 'Other information provided by the Cloud Service Provider'. Only in the latter case, this information is not subject to the auditor's procedures, and, accordingly, the auditor does not issue an opinion on it.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources