OPS-02 Capacity Management - Monitoring
Changed since C5:2020
Basic criterion
Slight linguistic adaptations.
Linked this criterion to the process for notifying cloud service customers about incidents defined in OPS-24.
Additional criterion
Specified that the additional criterion applies to resources managed by the cloud service customer.
Wording in C5:2020
Basic criterion
Technical and organisational safeguards for the monitoring and provisioning and de-provisioning of cloud services are defined. Thus, the Cloud Service Provider ensures that resources are provided and/or services are rendered according to the contractual agreements and that compliance with the service level agreements is ensured.
Additional criterion
To monitor capacity and availability, the relevant information is available to the cloud customer in a self-service portal.
Basic criterion
Procedures and technical safeguards for the monitoring, provisioning and de-provisioning of cloud services are defined. The cloud service provider ensures that resources are delivered as contractually agreed with the customers. The cloud service provider ensures compliance with the service level agreements.
Supplementary information
Technical and organisational measures typically include:
- Use of monitoring tools with alarm function when defined threshold values are exceeded;
- Process for correlating events and interface to incident management;
- Continuous monitoring of the systems by qualified personnel; and
- Redundancies in the IT systems.
Capacity restrictions that result in breaches of contractual obligations are to be reported to cloud service customers in accordance with OPS-24.
Supplementary information
Cloud service providers may provide a health dashboard to the cloud service customer. This subcriterion can be fulfilled by the provision of such a health dashboard if the health dashboard informs the cloud service customer about breaches of contractual obligations, such as SLAs.
Additional criterion
OPS-02.01AC
Additional, complementingTo monitor capacity and availability managed by the cloud service customer, the relevant information is available to the cloud service customer in a self-service portal.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the contractual agreements made with the cloud service provider for the provision of resources or services can be monitored. In case of deviations, appropriate controls ensure that the cloud service provider is informed so that the cloud service provider can take appropriate action.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources