Domains

OPS

Operations

35 criteria, 89 basic and 37 additional sub-criteria

• OPS-01Capacity ManagementPlanning4 sub-criteria: 3 basic, 1 additional, with customer criteria
• OPS-02Capacity ManagementMonitoring3 sub-criteria: 2 basic, 1 additional, with customer criteria
• OPS-03Capacity ManagementControlling of Resources2 sub-criteria, with customer criteria
• OPS-04Protection Against MalwarePolicies and Procedures1 sub-criterion
• OPS-05Protection Against MalwareImplementation7 sub-criteria: 3 basic, 4 additional, with customer criteria
• OPS-06Data Backup and RecoveryPolicies and Procedures2 sub-criteria: 1 basic, 1 additional, with customer criteria
• OPS-07Data Backup and RecoveryMonitoring3 sub-criteria: 2 basic, 1 additional, with customer criteria
• OPS-08Data Backup and RecoveryRegular Testing7 sub-criteria: 5 basic, 2 additional, with customer criteria
• OPS-09Data Backup and RecoveryStorage5 sub-criteria
• OPS-10Logging and MonitoringPolicies and Procedures1 sub-criterion, with customer criteria
• OPS-11Logging and MonitoringPolicies and Procedures for Handling Cloud Service Derived Data and Account Data4 sub-criteria: 2 basic, 2 additional, with customer criteria
• OPS-12Logging and MonitoringAccess, Retention and Deletion1 sub-criterion
• OPS-13Logging and MonitoringSecurity Information and Event Management5 sub-criteria: 2 basic, 3 additional
• OPS-14Logging and MonitoringRetention of the Logging Data3 sub-criteria, with customer criteria
• OPS-15Logging and MonitoringAccountability5 sub-criteria: 3 basic, 2 additional, with customer criteria
• OPS-16Logging and MonitoringConfiguration2 sub-criteria
• OPS-17Logging and MonitoringAvailability of the Monitoring Software4 sub-criteria: 2 basic, 2 additional
• OPS-18Managing Vulnerabilities - Policies and Procedures5 sub-criteria, with customer criteria
• OPS-19Managing Incidents and Crashes - Policies and Procedures1 sub-criterion, new in C5:2026
• OPS-20Managing Incidents - Implementation1 sub-criterion, new in C5:2026
• OPS-21Managing Crashes - Implementation1 sub-criterion, new in C5:2026
• OPS-22Managing Vulnerabilities, Incidents and CrashesPenetration Tests16 sub-criteria: 8 basic, 8 additional
• OPS-23Managing Vulnerabilities, Incidents and CrashesMeasurements, Analyses and Assessments of Procedures2 sub-criteria
• OPS-24Involvement of Cloud Service Customers in the Event of Incidents3 sub-criteria: 2 basic, 1 additional, with customer criteria
• OPS-25Managing Vulnerabilities, Incidents and CrashesVulnerability Scans7 sub-criteria: 4 basic, 3 additional, with customer criteria
• OPS-26Managing Vulnerabilities, Incidents and CrashesSystem Hardening7 sub-criteria: 6 basic, 1 additional, with customer criteria
• OPS-27Managing VulnerabilitiesPatch Management Policies and Procedures5 sub-criteria: 4 basic, 1 additional, new in C5:2026
• OPS-28Managing VulnerabilitiesPatch Management Implementation1 sub-criterion, new in C5:2026
• OPS-29Managing Vulnerabilities, Incidents and Crashes - Externally Sourced Components1 sub-criterion, new in C5:2026
• OPS-30Separation of DatasetsPolicies and Procedures1 sub-criterion, new in C5:2026
• OPS-31Separation of DatasetsImplementation3 sub-criteria, with customer criteria
• OPS-32Confidential ComputingPolicies and Procedures4 sub-criteria: 3 basic, 1 additional, new in C5:2026
• OPS-33Confidential ComputingRemote Attestation5 sub-criteria: 3 basic, 2 additional, new in C5:2026
• OPS-34Container ManagementPolicies and Procedures3 sub-criteria: 2 basic, 1 additional, new in C5:2026
• OPS-35Container ManagementImplementation1 sub-criterion, new in C5:2026

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources