# OPS-29 Managing Vulnerabilities, Incidents and Crashes - Externally Sourced Components

- Domain: OPS – Operations
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/ops-29/

## Basic criterion

### OPS-29.01B

The cloud service provider designs, implements and maintains technical and organisational measures to manage updates to system components used to provide the cloud service that incorporate third-party or open-source libraries. This includes:

1. Regularly identifying available updates and known vulnerabilities in third-party or open-source libraries used within applications;
2. Evaluating the potential impact of identified updates and vulnerabilities on the applications and the overall security posture;
3. Implementing necessary updates and patches in a timely manner to address identified vulnerabilities; and
4. Continuously monitoring applications to ensure updates are effectively applied and no known or unmitigated vulnerabilities are introduced.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.