OPS-25 Managing Vulnerabilities, Incidents and Crashes - Vulnerability Scans
Changed since C5:2020 · formerly OPS-22
Basic criterion
Reworded existing basic criterion to explicitly use the term "vulnerability scan".
Supplemented requirement regarding the performance of vulnerability scans with references to up-to-date vulenerability databases.
Added requirements regarding the assessment of severity and the remediation of vulnerabilities.
Linked this criterion to the use of the cloud service provider's SIEM.
Additional criterion
Sharpened time frame for the performance of vulnerability scans of the basic criterion from monthly to daily.
Supplemented requirement regarding the assessment of severity with references to CVSS.
Generalised the former additional criterion to allow cloud service providers to define reasonable remediation time frames based on a risk-based classification framework.
Wording in C5:2020
Basic criterion
System components in the area of responsibility of the Cloud Service Provider for the provision of the cloud service are automatically checked for known vulnerabilities at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18), the severity is assessed in accordance with defined criteria and measures for timely remediation or mitigation are initiated within defined time windows.
Additional criterion
Available security patches are applied depending on the severity of the vulnerabilities, as determined based on the latest version of the Common Vulnerability Scoring System (CVSS):
- Critical (CVSS = 9.0 - 10.0): 3 hours;
- High (CVSS = 7.0 - 8.9): 3 days;
- Average (CVSS = 4.0 - 6.9): 1 month;
- Low (CVSS = 0.1 - 3.9): 3 months.
Basic criterion
System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a comparison of software component data against up-to-date vulnerability databases (e.g., CVE, EUVD, etc.) to identify known vulnerabilities.
Supplementary information
Also applies to 01AS
In contrast to penetration tests (cf. OPS-22), which are carried out manually and according to an individual scheme, the check for open vulnerabilities is performed automatically, using so-called vulnerability scanners.
Definitions of the terms 'CVE' and 'EUVD', as well as other vulnerability-related terms, can be found in the supplementary information of criterion OPS-18.01B.
The software component data to be compared against up-to-date vulnerability databases can be, but does not have to be, obtained using a Software Bill of Materials (SBOM).
The cloud service provider assesses the severity of vulnerabilities in accordance with defined criteria.
Measures for timely remediation or mitigation are initiated within defined time frame.
The results of the vulnerability scans are used to update the cloud service provider's SIEM system (cf. OPS-13) rules, enabling the system to detect when known vulnerabilities are being actively exploited.
Additional criterion
OPS-25.01AS
Additional, sharpens01BSystem components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a day in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a comparison of software component data against up-to-date vulnerability databases (e.g., CVE, EUVD, etc.) to identify known vulnerabilities.
Supplementary information
Also applies to 01B
In contrast to penetration tests (cf. OPS-22), which are carried out manually and according to an individual scheme, the check for open vulnerabilities is performed automatically, using so-called vulnerability scanners.
Definitions of the terms 'CVE' and 'EUVD', as well as other vulnerability-related terms, can be found in the supplementary information of criterion OPS-18.01B.
The software component data to be compared against up-to-date vulnerability databases can be, but does not have to be, obtained using a Software Bill of Materials (SBOM).
OPS-25.02AS
Additional, sharpens02BThe cloud service provider assesses the severity of vulnerabilities using the latest version of the Common Vulnerability Scoring System (CVSS) valid at the time of the assessment.
OPS-25.01AC
Additional, complementingTime frames for the initiation of remediation or mitigation efforts after a vulnerability is identified are defined and monitored according to a risk-based classification framework. This framework incorporates, but is not limited to, the CVSS severity level of vulnerabilities.
Supplementary information
An example of a framework for risk-based classification and definition of time frames can be:
- Critical (CVSS = 9.0 - 10.0): 24 - 48 hours;
- High (CVSS = 7.0 - 8.9): 48 - 72 hours;
- Medium (CVSS = 4.0 - 6.9): 5 days; and
- Low (CVSS = 0.1 - 3.9): 1 month.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures. If cloud service customers operate virtual machines or containers with the cloud service, this also includes performing vulnerability scans to ensure that secure images (so-called golden images) provided by either the cloud service provider or the cloud service customer themselves are used.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources