# OPS-16 Logging and Monitoring - Configuration

- Domain: OPS – Operations
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ops-16/

## Basic criterion

### OPS-16.01B

Access to system components for logging and monitoring in the cloud service provider's area of responsibility is restricted to authorised users and requires authentication with two or more factors.

### OPS-16.02B

Changes to the configuration are made in accordance with the applicable policies (cf. DEV-03).

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Moved the requirement for the use of multi factor authentication from the additional criterion to the basic criterion.

**Additional criterion:**

Moved the requirement for the use of multi factor authentication from the additional criterion to the basic criterion.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.