# OPS-27 Managing Vulnerabilities - Patch Management Policies and Procedures

- Domain: OPS – Operations
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/ops-27/

**Supplementary information:**

Patches are defined as software updates to systems components with the goal of increasing security by addressing issues, vulnerabilities or exploits.

## Basic criterion

### OPS-27.01B

Policies and procedures with technical and organisational measures are documented, communicated and provided in accordance with SP-01 to ensure system components under the responsibility of the cloud service provider are patched within a suitable time frame depending on contractual agreements and identified vulnerabilities or exploits. These policies and procedures contain specifications regarding the following aspects:

1. Software is kept up-to-date, including timely deployment of security patches;
2. Patches are scheduled within maintenance windows, where applicable, to minimise service disruption; and
3. Patches are tested in non-production environments before they are rolled out into the production environment, provided testing was successful. Mechanisms are in place to revert to previous software versions in case of unexpected issues.

**Supplementary information:**

What constitutes as timely in the sense of this subcriterion depends on the criticality of the patched issue, vulnerability or exploit.

### OPS-27.02B

Patch management procedures are harmonised with the cloud service provider's overall software change management process (cf. DEV-03).

### OPS-27.03B

According to the measures and procedures of the overall change management, patches provided by third parties are identified, tested and deployed.

### OPS-27.04B

Systems are scanned after application of patches to ensure vulnerabilities and exploits are remediated and no known or unmitigated vulnerabilities or exploits were deployed.

**Supplementary information:**

The scans performed after the application of a patch can, but do not have to be, restricted to the system components to which the patch was applied.

## Additional criterion

### OPS-27.03AS (additional, sharpens 03B)

According to the measures and procedures of the overall change management, patches provided by third parties are identified, tested and deployed in an automated manner. In case of patches where manual intervention is required, an exception handling process for manual patching is defined.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.