# OPS-02 Capacity Management - Monitoring

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-02/

## Basic criterion

### OPS-02.01B

Procedures and technical safeguards for the monitoring, provisioning and de-provisioning of cloud services are defined. The cloud service provider ensures that resources are delivered as contractually agreed with the customers. The cloud service provider ensures compliance with the service level agreements.

**Supplementary information:**

Technical and organisational measures typically include:

1. Use of monitoring tools with alarm function when defined threshold values are exceeded;
2. Process for correlating events and interface to incident management;
3. Continuous monitoring of the systems by qualified personnel; and
4. Redundancies in the IT systems.

### OPS-02.02B

Capacity restrictions that result in breaches of contractual obligations are to be reported to cloud service customers in accordance with OPS-24.

**Supplementary information:**

Cloud service providers may provide a health dashboard to the cloud service customer. This subcriterion can be fulfilled by the provision of such a health dashboard if the health dashboard informs the cloud service customer about breaches of contractual obligations, such as SLAs.

## Additional criterion

### OPS-02.01AC (additional, complementing)

To monitor capacity and availability managed by the cloud service customer, the relevant information is available to the cloud service customer in a self-service portal.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the contractual agreements made with the cloud service provider for the provision of resources or services can be monitored. In case of deviations, appropriate controls ensure that the cloud service provider is informed so that the cloud service provider can take appropriate action.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Slight linguistic adaptations.

Linked this criterion to the process for notifying cloud service customers about incidents defined in OPS-24.

**Additional criterion:**

Specified that the additional criterion applies to resources managed by the cloud service customer.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.