# OPS-23 Managing Vulnerabilities, Incidents and Crashes - Measurements, Analyses and Assessments of Procedures

- Domain: OPS – Operations
- Since C5:2020: unchanged (formerly OPS-20)
- Web page: https://c5.patrickscheid.de/en/ops-23/

## Basic criterion

### OPS-23.01B

The cloud service provider regularly measures, analyses and assesses the procedures with which vulnerabilities and incidents are handled to verify their continued suitability, appropriateness and effectiveness.

**Supplementary information:**

The assessment of the suitability, appropriateness and effectiveness of procedures for managing vulnerabilities and incidents may be based on the following information:

1. Regular reporting of KPIs (Key Performance Indicators) that are volume, time-based or resolution/quality-based;
2. Customer complaints or the results of customer surveys about their satisfaction with the procedures; and
3. Results of internal or external audits.

KPIs for vulnerabilities include, for example:

1. Mean Time to Detect (MTTD, average time it takes to discover a vulnerability from its disclosure or creation);
2. Mean Time to Remediate (MTTR, average time it takes to fix or patch a vulnerability after it has been detected);
3. Number of open vulnerabilities at each severity level; and
4. Percentage of vulnerabilities that have been patched within a set period.

KPIs for incidents include, for example:

1. Number of incidents reported over a set period and how this evolved over the time;
2. Average response and resolution time;
3. Percentage of incidents resolved within the agreed-upon service level agreement; and
4. Percentage of incidents resolved during the first attempt for resolution.

### OPS-23.02B

Results are evaluated at least quarterly in a documented form by responsible individuals or groups of the cloud service provider to initiate continuous improvement actions and to verify their effectiveness.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.