OPS-18 Managing Vulnerabilities - Policies and Procedures
Changed since C5:2020
Basic criterion
Extended aspects to be addressed by the guidelines and instructions by the deployment of security patches, interfaces to incident management, requirements for the use of AI-based tools and information on the configuration of system components.
Supplemented aspects to be addressed by the guidelines and instructions with references to commonly used systems such as CWE and CVSS.
Added requirements regarding the engagement with identified vulnerabilities, including the decision not to remediate them.
Bullet points are now sorted to ease discussions about specific list items
Wording in C5:2020
Basic criterion
Guidelines and instructions with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure the timely identification and addressing of vulnerabilities in the system components used to provide the cloud service. These guidelines and instructions contain specifications regarding the following aspects:
- Regular identification of vulnerabilities;
- Assessment of the severity of identified vulnerabilities;
- Prioritisation and implementation of actions to promptly remediate or mitigate identified vulnerabilities based on severity and according to defined timelines; and
- Handling of system components for which no measures are initiated for the timely remediation or mitigation of vulnerabilities.
Basic criterion
Policies and procedures with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to govern the timely identification and addressing of vulnerabilities in the system components used to provide the cloud service. These policies and procedures contain specifications regarding the following aspects:
- Regular (proactive) identification of vulnerabilities through suitable measures, including vulnerability scans and penetration tests, considering typical vulnerability classes and Common Weaknesses (CWEs);
- Assessing the severity of identified vulnerabilities using the Common Vulnerability Scoring System (CVSS);
- Prioritising and implementing measures considering existing standards for timely remediation and/or mitigation of identified vulnerabilities based on severity according to defined time frames and with reference to commonly used scoring systems like the Exploit Prediction Scoring System (EPSS) and the Stakeholder-Specific Vulnerability Categorisation (SSVC);
- Deployment of Security Patches;
- Handling system components for which no measures for timely remediation or mitigation of vulnerabilities are initiated based on a risk assessment;
- Interfaces to incident management in case vulnerabilites become incidents;
- If AI-based tools are used for performing vulnerability scans or penetration tests, requirements for the comprehensible (traceable, transparent) documentation on the use of such tools and that these tools shall be used to support the cloud service provider's subject matter experts, not to replace them; and
- Providing information on the configuration of system components and cloud services, the existing vulnerabilities, and the available patches and/or mitigation measures, using widely adopted, preferably automated, formats.
Supplementary information
Suitable measures for the identification of vulnerabilities include implementing RFC 9116 in conjunction with a Coordinated Vulnerability Disclosure (CVD) Policy according to established guidelines like ISO/IEC TR 5895:2022 and ISO/IEC 29147:2018 and community standards like Google's Project Zero Vulnerability Disclosure Policy.
The Common Vulnerability Scoring System (CVSS) is a technical standard that can be used for assessing the severity of identified vulnerabilities. Scores are calculated based on a formula with several metrics that approximate ease and impact of an exploit. In CVSS version 4.0 the scores can be mapped to qualitative ratings as follows:
- Low: 0.1 - 3.9;
- Medium: 4.0 - 6.9;
- High: 7.0 - 8.9; and
- Critical: 9.0 - 10.0.
Widely adopted formats on the configuration of system components and cloud services, the existing vulnerabilities, and the available patches and/or mitigation measures include, but are not limited to:
- Software Bill of Materials (SBOM),
- Common Vulnerabilities and Exposures (CVE) or European Vulnerability Database (EUVD),
- Vulnerability, Exploitability eXchange (VEX); and
- Common Security Advisory Frameworks (CSAF).
The policies and procedures for the timely identification and addressing of vulnerabilities define that for vulnerabilities assessed to be 'critical', engagement has to begin in a timely manner after identification, even if this occurs outside regular working hours. They also define how such a vulnerability is engaged with.
The policies and procedures for the timely identification and addressing of vulnerabilities also define that for vulnerabilities assessed to be 'high', engagement has to begin within one working day after their identification. They also define how such a vulnerability is engaged with.
The engagement with a vulnerability according to the policies and procedures for the timely identification and addressing of vulnerabilities includes regular follow-up of the vulnerability until its remediation.
Based on a risk assessment (cf. OIS-07), the cloud service provider can decide not to remediate or mitigate identified vulnerabilities. Such a risk assessment and the compensating or mitigating measures are reviewed regularly and in case of significant changes to the cloud service.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they check system components in their area of responsibility for vulnerabilities on a regular basis and mitigate these with appropriate measures.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources