# OPS-28 Managing Vulnerabilities - Patch Management Implementation

- Domain: OPS – Operations
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/ops-28/

## Basic criterion

### OPS-28.01B

The cloud service provider designs, implements and maintains technical and organisational measures for the deployment of patches on the systems and applications under its responsibility according to the patch management policies and procedures (cf. OPS-27).

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.