# OPS-08 Data Backup and Recovery - Regular Testing

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-08/

**Supplementary information:**

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

## Basic criterion

### OPS-08.01B

Restore procedures are tested regularly, at least annually. The tests include cloud service provider data and, if contractually agreed upon, cloud service customer data and cloud service derived data.

**Supplementary information:**

The use of cloud service customer data in backup and restore procedures as described in the basic criterion is a carefully considered exception. This exception does not extend to general software development or other testing environments and the use of cloud service customer data for testing is restricted specifically to backup and restore procedures.

### OPS-08.02B

The tests allow an assessment as to whether the contractual agreements as well as the specifications for the maximum tolerable downtime (Recovery Time Objective, RTO) and the maximum permissible data loss (Recovery Point Objective, RPO) are adhered to (cf. BCM-02).

### OPS-08.03B

Cloud service customer data is only restored in environments that are subject to the same access restrictions as the production environment.

**Supplementary information:**

If cloud service customer data is restored in an environment with differing access restrictions, the confidentiality of the data may be affected.

### OPS-08.04B

Performed restore tests are thoroughly documented. This also includes the documentation of the safe disposal of the restored data.

### OPS-08.05B

Deviations from the specifications are reported to the responsible personnel or system components so that these can timely assess the deviations and initiate the necessary actions.

## Additional criterion

### OPS-08.01AC (additional, complementing)

At the customer's request, the cloud service provider informs the cloud service customer of the results of the restore tests.

### OPS-08.02AC (additional, complementing)

Restore tests are included in the cloud service provider's business continuity management.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they actively request information on the results of restore tests from the cloud service provider. Customers assess the effectiveness of applied data recovery strategies and integrate insights into their own emergency plans in alignment with their business needs and security standards.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Added requirement regarding the environments that cloud service customer data can be restored into.

Added requirement for the documentation of restore tests.

**Additional criterion:**

Added requirement about including restore tests in the cloud service provider's business continuity management.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.