# OPS-24 Involvement of Cloud Service Customers in the Event of Incidents

- Domain: OPS – Operations
- Since C5:2020: changed (formerly OPS-21)
- Web page: https://c5.patrickscheid.de/en/ops-24/

## Basic criterion

### OPS-24.01B

The cloud service provider periodically informs the cloud service customer on the status of incidents affecting the cloud service customer, or, where appropriate and necessary, involve the customer in the resolution, in a manner consistent with the contractual agreements.

### OPS-24.02B

As soon as an incident has been resolved from the cloud service provider's perspective, the cloud service customer is informed about the actions taken according to the contractual agreements.

## Additional criterion

### OPS-24.01AC (additional, complementing)

The cloud service provider defines and documents procedures in contractual agreements with cloud service customers that specify the involvement of the customer in confirming, within a specified time period, that a resolution has effectively addressed the root cause of an incident.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider regarding incidents that affect them, and that these notifications are forwarded in a timely manner to the department responsible for processing them so that appropriate action can be taken.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Linguistic adaptation without changes in content.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.