OPS-07 Data Backup and Recovery - Monitoring
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Linked criterion to the policies defined in OPS-06.
Additional criterion
No change.
Wording in C5:2020
Basic criterion
The execution of data backups is monitored by technical and organisational measures. Malfunctions are investigated by qualified staff and rectified promptly to ensure compliance with contractual obligations to cloud customers or the Cloud Service Provider's business requirements regarding the scope and frequency of data backup and the duration of storage.
Additional criterion
The relevant logs or summarised results are available to the cloud customer in a self-service portal for monitoring the data backup.
Supplementary information on all sub-criteria
If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.
Basic criterion
The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and procedures for data backup and recovery (cf. OPS-06).
Incidents are investigated by qualified personnel and rectified timely to ensure compliance with contractual obligations to cloud service customers or the cloud service provider's business requirements regarding the scope and frequency of data backup and the duration of storage.
Additional criterion
OPS-07.01AC
Additional, complementingThe relevant logs or summarised results are available to the cloud service customer in a self-service portal for monitoring the data backup.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the backup of data within their area of responsibility is monitored by technical and organisational measures.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources