# OPS-31 Separation of Datasets - Implementation

- Domain: OPS – Operations
- Since C5:2020: changed (formerly OPS-24)
- Web page: https://c5.patrickscheid.de/en/ops-31/

## Basic criterion

### OPS-31.01B

The cloud service provider designs, implements and maintains measures and procedures against threats to the separation of data sets according to the policies and procedures of OPS-30. The measures address prevention against, detection of and reaction to any incidents infringing the separation.

### OPS-31.02B

Cloud service customer data stored and processed on shared virtual and physical resources is securely and strictly separated according to a documented approach based on OIS-07 risk assessment and following policies on cryptography (cf. CRY-01) to ensure the confidentiality and integrity of this data.

**Supplementary information:**

Shared resources include CPU, RAM, storage space and networks. The separation of cloud service customer data on shared resources can take place, for example, in accordance with cloud layers described in the *CISA Cloud Security Technical Reference Architecture*. The separation on each shared resource is implemented as deemed appropriate based on the conducted risk assessment, which might also include not implementing a cryptographic separation for certain shared resources.

Where the adequacy and effectiveness of separation cannot be assessed with reasonable assurance (e.g. due to complex implementation), evidence may also be provided through expert third-party review results (e.g. penetration tests to validate the policies and procedures).

The separation of transmitted data is subject to criterion COS-06.

### OPS-31.03B

The risk assessment is reviewed as needed, especially in case of changes to the architecture of the cloud service, and at least annually. Measures are adjusted or improved as appropriate to ensure they remain commensurate with the risks.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the functions provided by the cloud service for separating shared virtual and physical resources are used in such way that risks related to separation are adequately addressed according to the data's protection needs.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Linked criterion to the newly included guideline for the separation of data sets and to the policy for the use of cryptographic mechanisms.

Added requirement for reviewing the risk assessment in regards to the data separation.

**Additional criterion:**

Additional criterion removed.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.