OPS-22 Managing Vulnerabilities, Incidents and Crashes - Penetration Tests
Changed since C5:2020 · formerly OPS-19
Basic criterion
Modified requirement regarding the frequency of performed penetration tests to include in case of significant changes as well.
Modified requirement regarding the documented penetration concept to also define the number and types of tests to be performed.
Added requirements regarding the selection of system components to be tested and the implementation of (multi-year) test plans.
Supplement requirements regarding the severity assessment with reference to CVSS.
Linked this criterion to the policy for managing vulnerabilities.
Added requirement for performing root cause analyses on found vulnerabilities.
Additional criterion
Sharpened the basic criterion by further requiring the engagement of external penetraion testers, test plans to include pre-launch and post-launch penetration tests, and the selection og system components to be tested to include threat modelling.
Added requirement regarding the use of architecture and configuration reviews for performing penetration tests.
Added requirement regarding the review of the penetration test's effectiveness.
Further qualified the use of threat modelling for prioritising system components to test.
Added requirement regarding the correlation of possible exploits and identified vulnerabilities with past incidents.
Wording in C5:2020
Basic criterion
The Cloud Service Provider has penetration tests carried out by qualified internal personnel or external service providers at least once a year. The penetration tests are carried out according to a documented test methodology and include the system components relevant to the provision of the cloud service in the area of responsibility of the Cloud Service Provider, which have been identified as such in a risk analysis.
The Cloud Service Provider assess the severity of the findings made in penetration tests according to defined criteria.
For findings with medium or high criticality regarding the confidentiality, integrity or availability of the cloud service, actions must be taken within defined time windows for prompt remediation or mitigation.
Additional criterion
The tests are carried out every six months. They must always be performed by independent external auditors. Internal personnel for penetration tests may support the external service providers.
Supplementary information on all sub-criteria
See section '1.2 Definitions' for the terms 'penetration test' and 'significant change'.
In contrast to vulnerability scans, which analyse code, penetration tests as referred to in this criterion mainly aim at probing the live system to uncover real-world vulnerabilities or weaknesses that only show up in the actual operation of the cloud service, thus creating the connection to criterion OPS-18.
There are three types of penetration tests:
- Black-box testing: Testing performed without prior knowledge of the internal structure/design/implementation of the object being tested;
- Grey-box testing: Testing performed with partial knowledge of the internal structure/design/implementation of the object being tested; and
- White-box testing: Testing performed with knowledge of the internal structure/design/implementation of the object being tested.
It can further be distinguished between
- Pre-launch penetration testing: Testing already performed as part of the software development process during the test phase of the cloud service (cf. DEV-07); and
- Post-launch penetration testing: Testing carried out during the regular operations of the cloud service.
Significant changes may include, but are not limited to, the following events:
- Replacing core cloud infrastructure technologies or performing major version upgrades;
- Moving between service organisations, such as switching to a new IaaS or data centre provider;
- Material changes in the way cloud service customer data is processed and stored, such as new backup technologies or new regions from which the service is operated;
- Replacing or performing major upgrades on security technologies such as authentication workflows, network security mechanisms or monitoring mechanisms; and
- Material changes to the cloud service model or of functionality made available to the cloud service customer.
Basic criterion
The cloud service provider performs penetration tests by qualified internal personnel or external penetration testers at least once a year and in case of significant changes to the cloud service in accordance with the policies for managing vulnerabilities (cf. OPS-18).
Supplementary information
Also applies to 01AS
The qualification and competence of personnel for penetration tests can be verified based on professional certifications, e.g. as BSI-certified IS penetration tester or CREST-certified Cyber Security Professional.
Penetration tests are carried out in accordance with a documented framework for penetration tests that outlines the number and types of penetration tests to be performed and the requirements for the qualification and competence of the personnel to perform such tests. The number and types of penetration tests to be performed are determined based on a risk assessment (cf. OIS-07).
Supplementary information
Also applies to 02AS
How many penetration tests should be performed within a year depends on factors such as the size and complexity of the provided cloud service. If penetration tests follow multi-year test plans, these should be considered when determining the number and types of penetration tests to be performed within a year.
Penetration tests target the system components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider. System components to be targeted are identified in a risk assessment.
Supplementary information
Also applies to 03AS
The risk assessment should be used to identify the system components that are most critical for the provision of the cloud service or most relevant for penetration testing.
Supplementary information
Also applies to 05B
System components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider can comprise such system components that are exposed at the external perimeter of the network or components accessible only from inside the network.
Penetration tests are carried out in accordance with test plans that cover all relevant system components and specify which system components are to be tested.
If penetration tests follow multi-year test plans, each relevant system component is subjected to at least one penetration test within a maximum period of three years.
Supplementary information
Also applies to 03B
System components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider can comprise such system components that are exposed at the external perimeter of the network or components accessible only from inside the network.
The cloud service provider assesses the severity of identified vulnerabilities in accordance with the Common Vulnerability Scoring System (CVSS), in the latest version valid at the time of the assessment.
Actions for remediation or mitigation are taken in accordance with the time frames as defined in the policies for managing vulnerabilities (cf. OPS-18).
The vulnerabilities discovered through penetration testing are subject to a root cause analysis. The root cause analysis enables an assessment of the extent to which similar vulnerabilities may be present in the cloud service.
Additional criterion
OPS-22.01AS
Additional, sharpens01BThe cloud service provider performs penetration tests at least every six months and in case of significant changes to the cloud service by independent external penetration testers in accordance with the policies for managing vulnerabilities (cf. OPS-18). The external penetration testers are engaged only if the personnel supposed to perform the test verifiably meets the cloud service provider's qualification and competence requirements. Internal personnel for penetration tests may support the external personnel.
Supplementary information
Also applies to 01B
The qualification and competence of personnel for penetration tests can be verified based on professional certifications, e.g. as BSI-certified IS penetration tester or CREST-certified Cyber Security Professional.
OPS-22.02AS
Additional, sharpens02BPre-launch and post-launch penetration tests are performed in accordance with a documented framework for penetration tests that outlines the number and types of penetration tests to be performed and the requirements for the qualification and competence of the personnel to perform such tests. The number and types of penetration tests to be performed are determined based on a risk assessment (cf. OIS-07).
Supplementary information
Also applies to 02B
How many penetration tests should be performed within a year depends on factors such as the size and complexity of the provided cloud service. If penetration tests follow multi-year test plans, these should be considered when determining the number and types of penetration tests to be performed within a year.
OPS-22.03AS
Additional, sharpens03BPenetration tests target system components relevant to the provision of the cloud service in the area of responsibility of the cloud service provider. System components to be targeted are identified in a risk assessment incorporating, where applicable, threat modelling.
Supplementary information
Also applies to 03B
The risk assessment should be used to identify the system components that are most critical for the provision of the cloud service or most relevant for penetration testing.
OPS-22.01AC
Additional, complementingPenetration tests are performed based on reviews of the architecture and configuration of the system components, and of the cloud service provider's source code.
OPS-22.02AC
Additional, complementingThe cloud service provider designs a multi-year test plan for its penetration testing activities.
OPS-22.03AC
Additional, complementingThe cloud service provider reviews the effectiveness of penetration tests on system components at least annually, and in case of significant changes to the cloud service.
OPS-22.04AC
Additional, complementingThe cloud service provider uses the threat modelling process to prioritise system components with the highest risk exposure for penetration testing by systematically analysing cloud components, services, data flows, trust boundaries and assets critical to the cloud service to enumerate potential threats, vulnerabilities, and attack vectors.
Supplementary information
This subcriterion is only applicable if subcriterion OPS-22.03AS is applied as well.
The risk-based scoping ensures that penetration tests focus on the areas most susceptible to security threats, improves business alignment and collaboration, and provides clear technical insight into which components require testing beyond standard risk evaluation.
For the threat modelling process, a structured threat modelling approach such as STRIDE, DREAD, PASTA, or hybrid methodologies tailored for cloud environments can be used.
OPS-22.05AC
Additional, complementingThe cloud service provider correlates the possible exploits of discovered vulnerabilities with previous information security incidents to identify if the vulnerability may have been exploited before its discovery.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources