# OPS-14 Logging and Monitoring - Retention of the Logging Data

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-14/

## Basic criterion

### OPS-14.01B

The cloud service provider retains the generated log data, including SIEM log data, and keeps it in an appropriate, unchangeable and aggregated form, regardless of the source of such data, so that a central, authorised evaluation of the data is possible.

### OPS-14.02B

Log data is deleted if it is no longer required for the purpose for which it was collected.

### OPS-14.03B

Between logging servers and the assets to be logged, authentication measures are in place to protect the integrity and authenticity of the information transmitted and stored. The transfer uses state of the art encryption or a dedicated administration network (out-of-band management).

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they determine whether they require access to the customer-specific portion of the cloud service derived data that consists of log data, and if so, actively request it.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Extended criterion to include SIEM log data as well.

**Additional criterion:**

Additional criterion removed.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.