# OPS-09 Data Backup and Recovery - Storage

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-09/

**Supplementary information:**

If the data backup has not been contractually agreed between the cloud service provider and the cloud service customer, this criterion is not applicable. The cloud service provider transparently presents this situation in the system description.

## Basic criterion

### OPS-09.01B

The cloud service provider transfers cloud service provider data and, if contractually agreed upon, cloud service customer data and cloud service derived data to be backed up to a remote location or transports these on backup media to a remote location.

**Supplementary information (on 01B, 03B, 04B, 05B):**

A remote location can be e.g. another data centre of the cloud service provider.

### OPS-09.02B

The protection needs resulting from the data classification of the original data (e.g., encryption, access control) are also applied to backups.

### OPS-09.03B

If the data backup is transmitted to the remote location via a network, the data backup or the transmission of the data takes place in an encrypted form that corresponds to the state of the art (cf. CRY-04).

### OPS-09.04B

The distance to the main site is chosen after sufficient consideration of the factors recovery times and impact of disasters on both sites.

### OPS-09.05B

The physical and environmental security measures at the remote site are equivalent to those at the main site.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Added requirement for applying the data classification about the backed-up data to its baclup.

Linked criterion to the criterion for transport protection.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.