# OPS-04 Protection Against Malware - Policies and Procedures

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-04/

## Basic criterion

### OPS-04.01B

Policies and procedures with specifications for protection against malware are documented, communicated, and provided in accordance with SP-01 with respect to the following aspects:

1. Use of system-specific protection mechanisms;
2. Operating protection programmes on system components under the responsibility of the cloud service provider;
3. Operation of protection programmes for personnel's terminal equipment; and
4. Operation of protection programmes on flows coming in over cloud service provider end-devices, as well as all other incoming flows.

**Supplementary information:**

Protection programmes for personnel devices can be, for example, server-based protection programmes that scan files in attachments on the server or filter network traffic.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirement for the operation of protection programmes on all incoming flows.

Bullet points are now sorted to ease discussions about specific list items.

**Additional criterion:**

Additional criterion moved to the basic and additional criterion of OPS-05 instead.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.