OPS-12 Logging and Monitoring - Access, Retention and Deletion
Changed since C5:2020
Basic criterion
Linked criterion the mentioned criteria.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
The requirements for the logging and monitoring of events and for the secure handling of metadata are implemented by technically supported procedures with regard to the following restrictions:
- Access only to authorised users and systems;
- Retention for the specified period; and
- Deletion when further retention is no longer necessary for the purpose of collection.
Basic criterion
The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data (cf. OPS-10, OPS-11) are implemented by technically supported procedures with regard to the following restrictions:
- Access only for authorised users and systems;
- Retention for the specified period; and
- Deletion when further retention is no longer necessary for the purpose of collection.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources