# OPS-13 Logging and Monitoring - Security Information and Event Management

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-13/

## Basic criterion

### OPS-13.01B

The cloud service provider integrates relevant log data (cloud service derived data and cloud service provider data) into a Security Information and Event Management (SIEM) system to establish a seamless connection between logging, monitoring, and security incident management.

### OPS-13.02B

The SIEM system is deployed within the cloud environment or externally and includes the following capabilities:

1. Standardisation of log data;
2. Automated analysis to identify and correlate potential security incidents;
3. Capabilities to detect unusual behaviour and potential threats;
4. Real-time alerting to inform the incident response team of critical events;
5. Reporting to the incident response team in case new information relevant to an event becomes available; and
6. Automated response mechanisms for addressing security incidents.

## Additional criterion

### OPS-13.01AC (additional, complementing)

The cloud service provider validates the correct operation of event detection processes on appropriate assets. The appropriateness of the assets is identified in accordance with the asset classification schema (cf. AM-09).

### OPS-13.02AC (additional, complementing)

Timely and appropriate remediation measures address any deviations identified during validation.

### OPS-13.03AC (additional, complementing)

If an event that can lead to security incidents is identified, incident handling activities by the cloud service provider are triggered without undue delay.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Realigned criterion to center around the deployment and use of a SIEM for monitoring events.

**Additional criterion:**

Additional criterion newly  included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.