# PS-02 Redundancy Model

- Domain: PS – Physical Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ps-02/

## Basic criterion

### PS-02.01B

The cloud service is provided from at least two locations. The locations meet the security requirements of the cloud service provider (cf. PS-01) and are located in an adequate distance to each other to achieve operational redundancy and resilience.

**Supplementary information (on 01B, 02B):**

Operational redundancy of the sites to each other in the sense of this criterion is given if based on the assessment of elementary risks at the site corresponding distances of the premises and buildings to these risks are maintained. Very extensive events which, due to their extent, could affect several sites of the same redundancy group simultaneously or in a timely manner (e.g. floods, earthquakes) are not considered.

There are cloud service providers who no longer address the issue of reliability of the cloud service on a physical level through redundancy from two independent locations, but through resilience. The cloud service is provided simultaneously from more than two locations. The underlying distributed data centre architecture ensures that the failure of a location or components of a location does not violate the defined availability criteria of the cloud service. Such an architecture can represent an alternative fulfilment (cf. Chapter 3.4.12) of the criterion. The tests and exercises on functionality required in the criterion also apply analogously to resilient architectures.

### PS-02.02B

Operational redundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met.

### PS-02.03B

The effectiveness of the redundancy is checked at least annually by suitable tests and exercises (cf. BCM-04).

## Additional criterion

### PS-02.01AS (additional, sharpens 01B)

The cloud service is provided from more than two locations. The locations meet the security requirements of the cloud service provider (cf. PS-01) and are located sufficiently far apart to achieve georedundancy and resilience. If two locations fail at the same time, at least one third location is still available to prevent a total service failure.

**Supplementary information (on 01AS, 02AS):**

A georedundancy of the sites to each other in the sense of this criterion is given if a very extensive event at a site under no circumstances affects several sites of the same redundancy group simultaneously or promptly. The BSI publication 'Kriterien für die Standortwahl von Rechenzentren' (German for: 'Criteria for selecting the location of data centres', document only available in German) provides recommendations in this regard.

### PS-02.02AS (additional, sharpens 02B)

The georedundancy is designed in a way that ensures that the availability requirements specified in the service level agreement are met.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the existing redundancy model of the cloud service provider and the evidence for the verification of the model comply with their own requirements for the availability and reliability of the cloud service.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified that the two locations should provide each other with resilience as well.

Modified requirement for checking the functionality to be for checking the effectiveness of the redundancy.

**Additional criterion:**

Removed requirement for checking the effectiveness of the redundancy, as this is, with the new way criteria are structure in C5:2026, already covered by the basic criterion.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.