# OPS-34 Container Management - Policies and Procedures

- Domain: OPS – Operations
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/ops-34/

## Basic criterion

### OPS-34.01B

Policies and procedures with technical and organisational measures for the planning and management of containers are documented, communicated and provided in accordance with SP-01. These policies and procedures contain specifications for the entire container life cycle regarding at least the following aspects:

1. Image creation, testing, and validation;
2. Image storage and retrieval;
3. Container deployment and management;
4. Container operations; and
5. Decommissioning of images and container.

### OPS-34.02B

The policies and procedures describe measures along the life cycle of containers and address at least the following aspects:

1. Containers are inventoried according to a documented process (cf. AM-02, AM-03, AM-09);
2. The need for malware protection is assessed and, if necessary, ensured (cf. OPS-05);
3. Logging and monitoring of events takes place along the container lifecycle and is executed according to a defined logging framework (cf. OPS-10, OPS-12);
4. Cloud service customer data is separated based on a risk assessment (cf. OPS-30);
5. Access to the container host should take place in accordance with a roles and rights framework and a policy for managing access and access authorisations (cf. IAM-01, IAM-06);
6. Data stored on containers and data in transit should be encrypted as far as possible by the provider in accordance with the encryption policy (cf. CRY-01);
7. Measures to ensure network security are established. This includes, for example, measures to detect network anomalies (cf. COS-01 and COS-03) such as unexpected data flows within the network or unwanted access attempts;
8. Changes to containers and images follow a regulated process (cf. DEV-03); and
9. Hardening processes are carried out according to general industry standards to ensure that no unnecessary system services are executed (cf. PSS-11).

## Additional criterion

### OPS-34.01AC (additional, complementing)

The policies and procedures additionally describe measures along the life cycle of containers that address at least the following aspects:

1. Container images are cryptographically signed and the signing key securely stored (cf. CRY-10) to ensure their authenticity and integrity;
2. Container behaviour is monitored and restricted using runtime security controls; and
3. Software products used for the provision of container images are, where possible, regularly scanned for known vulnerabilities or malicious components in container images and dependencies.

**Supplementary information:**

In case of third-party and open source software products used for the provision of container images, scanning procedures comply with the policies and procedures defined in DEV-14.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.