OPS-16 Logging and Monitoring - Configuration
Changed since C5:2020
Basic criterion
Moved the requirement for the use of multi factor authentication from the additional criterion to the basic criterion.
Additional criterion
Moved the requirement for the use of multi factor authentication from the additional criterion to the basic criterion.
Wording in C5:2020
Basic criterion
Access to system components for logging and monitoring in the Cloud Service Provider’s area of responsibility is restricted to authorised users. Changes to the configuration are made in accordance with the applicable policies (cf. DEV-03).
Additional criterion
Access to system components for logging and monitoring in the Cloud Service Provider's area of responsibility requires two-factor authentication.
Basic criterion
Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.
Changes to the configuration are made in accordance with the applicable policies (cf. DEV-03).
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources