# OPS-07 Data Backup and Recovery - Monitoring

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-07/

**Supplementary information:**

If the data backup of cloud service customer data is not part of the contract concluded between the cloud service provider and the cloud service customer, this criterion is not applicable for cloud service customer data, but it is still applicable for cloud service derived data and cloud service provider data. The extent to which the criterion is applicable to the cloud service is presented in the system description.

## Basic criterion

### OPS-07.01B

The execution of backups of cloud service customer data, cloud service derived data and cloud service provider data is monitored by technical and organisational measures documented and implemented in accordance with the policies and procedures for data backup and recovery (cf. OPS-06).

### OPS-07.02B

Incidents are investigated by qualified personnel and rectified timely to ensure compliance with contractual obligations to cloud service customers or the cloud service provider's business requirements regarding the scope and frequency of data backup and the duration of storage.

## Additional criterion

### OPS-07.01AC (additional, complementing)

The relevant logs or summarised results are available to the cloud service customer in a self-service portal for monitoring the data backup.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the backup of data within their area of responsibility is monitored by technical and organisational measures.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Linked criterion to the policies defined in OPS-06.

**Additional criterion:**

No change.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.