OPS-11 Logging and Monitoring - Policies and Procedures for Handling Cloud Service Derived Data and Account Data
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Linguistic adaptations and reordering of elements within the list.
Modified requirement regarding the allowed collection of cloud service derived data (formerly: metadata) to be restricted to administering and operating the cloud service
Removed aspect of immediately deleting cloud service derived data (formerly: metadata) upon the collection purpose being fulfilled.
Added aspect of protecting the confidentiality and integrity of the logs.
Extended the requirements regarding the use of anonymsed cloud service derived data.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Added requirement about taking data into consideration in regulatory compliance assessments.
Wording in C5:2020
Basic criterion
Policies and instructions for the secure handling of metadata (usage data) are documented, communicated and provided according to SP-01 with regard to the following aspects:
- Metadata is collected and used solely for billing, incident management and security incident management purposes;
- Exclusively anonymous metadata to deploy and enhance the cloud service so that no conclusions can be drawn about the cloud customer or user;
- No commercial use;
- Storage for a fixed period reasonably related to the purposes of the collection;
- Immediate deletion if the purposes of the collection are fulfilled and further storage is no longer necessary.
- Provision to cloud customers according to contractual agreements.
Additional criterion
Personal data is automatically removed from the log data before the Cloud Service Provider processes it as far as technically possible. The removal is done in a way that allows the Cloud Service Provider to continue to use the log data for the purpose for which it was collected.
Basic criterion
Policies and procedures for the secure handling of cloud service derived data and account data are documented, communicated and provided according to SP-01 with regard to at least the following aspects:
- Cloud service derived data and account data is collected and used solely to administer and operate the cloud service, including purposes related to the implementation of security controls;
- No commercial use beyond the aforementioned purpose to administer and operate the cloud service;
- Storage for a fixed period reasonably related to the purposes of the collection;
- The confidentiality and integrity of the logs is protected through appropriate security controls;
- As far as technically possible, anonymised cloud service derived data is used only in a way so that no conclusions can be drawn about the usage behaviour of individual users of the cloud service customer;
- Cloud service derived data that has been fully anonymised and cannot be traced back to individual cloud service customers may be further processed and retained, provided no contractual or legal restrictions exist, otherwise immediate deletion if the purposes of the collection are fulfilled and further storage is no longer necessary; and
- Provision to cloud service customers according to contractual agreements.
Supplementary information
The collection and use of cloud service derived data and account data for the administration and operation of the cloud service also includes the analysis of the aforementioned data to the purpose of improving the provided cloud service, unless this improvement only serves the economic interests of the cloud service provider.
If the cloud service provider acts as a cloud service broker, the policies and procedures should give special consideration to the complexities of handling cloud service derived data and account data as part of this role.
The cloud service provider specifies in the contractual agreements with cloud service customers all purposes for which cloud service derived data are collected and used, except for those purposes that are inherent to the general operation of all cloud services.
Supplementary information
Purposes that are inherent to the general operation of many cloud services are:
- Capacity planning and resource management;
- Security monitoring and incident response;
- Compliance with regulatory requirements; and
- Service performance and reliability.
Additional criterion
OPS-11.01AC
Additional, complementingPersonal data is automatically removed from the log data before the cloud service provider processes it, as far as technically possible. The removal is done in a way that allows the cloud service provider to continue to use the log data for the purpose for which it was collected.
OPS-11.02AC
Additional, complementingCloud service derived data, particularly log data, is included in regulatory compliance assessments.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that their contracts with the cloud service provider clearly outline the permissible uses of cloud service derived data. Cloud service customers verify that such data processing complies with contractual or legal restrictions and understand that the provider is obligated to delete data when it is no longer necessary for its initial purposes, unless agreed otherwise.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources