PS-03 Perimeter Protection
Changed since C5:2020
Basic criterion
Removed specification the the detection of unauthorised access is to occur in a timely manner.
Modified requirements regarding the construction element's ability to withstand a burglary attempt so that the construction elements need to meet the associated requirements as a whole, and compensating controls can be implemented if they cannot do so.
Added requirement for the training of data centre personnel.
Additional criterion
No change.
Wording in C5:2020
Basic criterion
The structural shell of premises and buildings related to the cloud service provided are physically solid and protected by adequate security measures that meet the security requirements of the Cloud Service Provider (cf. PS-01 Security Concept).
The security measures are designed to detect and prevent unauthorised access in a timely manner so that it does not compromise the information security of the cloud service.
The outer doors, windows and other construction elements reach a level appropriate to the security requirements and withstand a burglary attempt for at least 10 minutes.
The surrounding wall constructions as well as the locking mechanisms meet the associated requirements.
Additional criterion
The security measures installed at the site include permanently present security personnel (at least 2 individuals), video surveillance and anti-burglary systems.
Basic criterion
The structural shell of premises and buildings related to the cloud service provided are physically solid and protected by adequate security measures that meet the security requirements of the cloud service provider (cf. PS-01).
The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.
Supplementary information
Security measures for detecting unauthorised access can be security personnel, video surveillance or anti-burglary systems.
The outer doors, windows and other construction elements exhibit an appropriate security level so that their combined resistance time withstand a break-in attempt for at least ten minutes in total. This time period applies from the moment an external intruder is detected (e.g. by perimeter surveillance).
Supplementary information
Also applies to 04B
The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard. However, fulfilling the objective of this criteria does not necessarily imply that those standards have to be fulfilled.
Additionally, the subcriterion demands that all construction elements as a whole lead to a resistance time to break-in attempts for at least ten minutes. Consequently, it does not necessarly demand that all individual construction elements have to fulfil this requirement on their own, provided the combined measures effectively delay an external attack for the required time.
The surrounding wall constructions as well as the locking mechanisms meet the associated requirements.
Supplementary information
Also applies to 03B
The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard. However, fulfilling the objective of this criteria does not necessarily imply that those standards have to be fulfilled.
Additionally, the subcriterion demands that all construction elements as a whole lead to a resistance time to break-in attempts for at least ten minutes. Consequently, it does not necessarly demand that all individual construction elements have to fulfil this requirement on their own, provided the combined measures effectively delay an external attack for the required time.
If the construction elements as a whole do not fully meet the associated requirements, compensating controls are implemented to restore the appropriate security level.
Supplementary information
Compensating measures can include additional security layers (e.g. security areas) on the premise, an increased presence of security personnel, video surveillance and anti-burglary systems.
Data centre personnel are trained on how to respond effectively to unauthorised ingress or egress attempts.
Additional criterion
PS-03.01AC
Additional, complementingThe security measures installed at the site include permanently present security personnel (at least two individuals), video surveillance and anti-burglary systems.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources