# OPS-03 Capacity Management - Controlling of Resources

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-03/

## Basic criterion

### OPS-03.01B

Depending on the capabilities of the respective service model, the cloud service customer can control and monitor the allocation of the system components assigned to the customer for administration/use in order to avoid overcrowding of resources and to achieve sufficient performance.

**Supplementary information:**

System components to be allocated and managed by the cloud service customer can include, according to the possibilities of the service model:

1. Computing capacity;
2. Storage capacity;
3. Configuration of network properties;
4. Application Programming Interfaces (APIs); and
5. Databases.

System component allocation may need to take into account any container-based infrastructure used in the service models.

### OPS-03.02B

If there are significant security changes, or planned significant security changes, in the system components provided as part of the cloud service and allocated by the cloud service customer, the cloud service provider informs the cloud service customer about them.

**Supplementary information:**

Significant security changes in this context can include the change of the security feature itself, such as when changing the service architecture. Non-significant changes can include the change of the implementation of a security feature in a way that does not alter its functionality or reduce its security level, such as when replacing a used cryptographic primitive with another, equivalent one.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they manage and monitor the system resources in their area of responsibility.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirement for the cloud service provider informing the cloud service customer about significant security changes in system components allocated by them.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.