OPS-15 Logging and Monitoring - Accountability
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Added further description of the information included in the logs.
Modify requirement regarding forensic analyses to focus on supporting such analyses and retaining a chain of evidence.
Additional criterion
Added further requirements on the preservation of the integrity and reliability of logs.
Wording in C5:2020
Basic criterion
The log data generated allows an unambiguous identification of user accesses at tenant level to support (forensic) analysis in the event of a security incident.
Interfaces are available to conduct forensic analyses and perform backups of infrastructure components and their network communication.
Additional criterion
On request of the Cloud customer, the Cloud Service Provider provides the logs relating to the cloud customer in an appropriate form and in a timely manner so that the cloud customer can investigate any incidents relating to them.
Basic criterion
The log data generated - compromising both cloud service derived data and cloud service provider data - enables unambiguous identification of user access at the tenant level, supporting effective forensic analysis in the event of a security incident.
Each logged event includes a time/date stamp to ensure accurate and traceable records.
The cloud service provider is able to support forensic analysis of incidents and to retain a chain of evidence. This implies that the cloud service provider capture the state of hardware objects and network communication during security events.
Additional criterion
OPS-15.01AC
Additional, complementingOn request of the cloud service customer, the cloud service provider provides the logs relating to the cloud service customer in an appropriate form and in a timely manner so that the cloud service customer can investigate any incidents relating to them.
Supplementary information
The additional criterion also refers to logs of system components under the responsibility of the cloud service provider, to which the cloud service customer generally has no access, insofar as these logs are relevant for the analysis of security incidents and for identifying access to cloud service customer service data (cf. IAM-07 and INQ-03). For logging of system components under the responsibility of the cloud service provider cf. PSS-04.
OPS-15.02AC
Additional, complementingThe aforementioned logs are collected and maintained using controls and processes that preserve their integrity and reliability for security monitoring and incident investigation purposes. This implies, but is not limited to:
- Records are complete and have not been tampered with in any way;
- Logging systems are clock synchronised, logs include accurate timestamps;
- Copies of electronic evidence are provably identical to the originals; and
- Any information system from which evidence has been gathered was operating correctly at the time the evidence was recorded.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that unique user IDs are assigned which allow a corresponding analysis in the event of an incident.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources