# OPS-25 Managing Vulnerabilities, Incidents and Crashes - Vulnerability Scans

- Domain: OPS – Operations
- Since C5:2020: changed (formerly OPS-22)
- Web page: https://c5.patrickscheid.de/en/ops-25/

## Basic criterion

### OPS-25.01B

System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a month in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a comparison of software component data against up-to-date vulnerability databases (e.g., CVE, EUVD, etc.) to identify known vulnerabilities.

**Supplementary information (on 01B, 01AS):**

In contrast to penetration tests (cf. OPS-22), which are carried out manually and according to an individual scheme, the check for open vulnerabilities is performed automatically, using so-called vulnerability scanners.

Definitions of the terms 'CVE' and 'EUVD', as well as other vulnerability-related terms, can be found in the supplementary information of criterion OPS-18.01B.

The software component data to be compared against up-to-date vulnerability databases can be, but does not have to be, obtained using a Software Bill of Materials (SBOM).

### OPS-25.02B

The cloud service provider assesses the severity of vulnerabilities in accordance with defined criteria.

### OPS-25.03B

Measures for timely remediation or mitigation are initiated within defined time frame.

### OPS-25.04B

The results of the vulnerability scans are used to update the cloud service provider's SIEM system (cf. OPS-13) rules, enabling the system to detect when known vulnerabilities are being actively exploited.

## Additional criterion

### OPS-25.01AS (additional, sharpens 01B)

System components in the area of responsibility of the cloud service provider for the provision of the cloud service are subject to vulnerability scans at least once a day in accordance with the policies for handling vulnerabilities (cf. OPS-18). These vulnerability scans include a comparison of software component data against up-to-date vulnerability databases (e.g., CVE, EUVD, etc.) to identify known vulnerabilities.

### OPS-25.02AS (additional, sharpens 02B)

The cloud service provider assesses the severity of vulnerabilities using the latest version of the Common Vulnerability Scoring System (CVSS) valid at the time of the assessment.

### OPS-25.01AC (additional, complementing)

Time frames for the initiation of remediation or mitigation efforts after a vulnerability is identified are defined and monitored according to a risk-based classification framework. This framework incorporates, but is not limited to, the CVSS severity level of vulnerabilities.

**Supplementary information:**

An example of a framework for risk-based classification and definition of time frames can be:

1. Critical (CVSS = 9.0 - 10.0): 24 - 48 hours;
2. High (CVSS = 7.0 - 8.9): 48 - 72 hours;
3. Medium (CVSS = 4.0 - 6.9): 5 days; and
4. Low (CVSS = 0.1 - 3.9): 1 month.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures. If cloud service customers operate virtual machines or containers with the cloud service, this also includes performing vulnerability scans to ensure that secure images (so-called golden images) provided by either the cloud service provider or the cloud service customer themselves are used.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Reworded existing basic criterion to explicitly use the term "vulnerability scan".

Supplemented requirement regarding the performance of vulnerability scans with references to up-to-date vulenerability databases.

Added requirements regarding the assessment of severity and the remediation of vulnerabilities.

Linked this criterion to the use of the cloud service provider's SIEM.

**Additional criterion:**

Sharpened time frame for the performance of vulnerability scans of the basic criterion from monthly to daily.

Supplemented requirement regarding the assessment of severity with references to CVSS.

Generalised the former additional criterion to allow cloud service providers to define reasonable remediation time frames based on a risk-based classification framework.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.