# OPS-12 Logging and Monitoring - Access, Retention and Deletion

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-12/

## Basic criterion

### OPS-12.01B

The requirements for the logging and monitoring of events and for the secure handling of cloud service derived data and cloud service provider data (cf. OPS-10, OPS-11) are implemented by technically supported procedures with regard to the following restrictions:

1. Access only for authorised users and systems;
2. Retention for the specified period; and
3. Deletion when further retention is no longer necessary for the purpose of collection.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Linked criterion the mentioned criteria.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.