OPS-03 Capacity Management - Controlling of Resources
Changed since C5:2020
Basic criterion
Added requirement for the cloud service provider informing the cloud service customer about significant security changes in system components allocated by them.
Wording in C5:2020
Basic criterion
Depending on the capabilities of the respective service model, the cloud customer can control and monitor the allocation of the system resources assigned to the customer for administration/use in order to avoid overcrowding of resources and to achieve sufficient performance.
Basic criterion
Depending on the capabilities of the respective service model, the cloud service customer can control and monitor the allocation of the system components assigned to the customer for administration/use in order to avoid overcrowding of resources and to achieve sufficient performance.
Supplementary information
System components to be allocated and managed by the cloud service customer can include, according to the possibilities of the service model:
- Computing capacity;
- Storage capacity;
- Configuration of network properties;
- Application Programming Interfaces (APIs); and
- Databases.
System component allocation may need to take into account any container-based infrastructure used in the service models.
If there are significant security changes, or planned significant security changes, in the system components provided as part of the cloud service and allocated by the cloud service customer, the cloud service provider informs the cloud service customer about them.
Supplementary information
Significant security changes in this context can include the change of the security feature itself, such as when changing the service architecture. Non-significant changes can include the change of the implementation of a security feature in a way that does not alter its functionality or reduce its security level, such as when replacing a used cryptographic primitive with another, equivalent one.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they manage and monitor the system resources in their area of responsibility.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources