# PS-03 Perimeter Protection

- Domain: PS – Physical Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ps-03/

## Basic criterion

### PS-03.01B

The structural shell of premises and buildings related to the cloud service provided are physically solid and protected by adequate security measures that meet the security requirements of the cloud service provider (cf. PS-01).

### PS-03.02B

The security measures are designed to detect and prevent unauthorised access so that the information security of the cloud service is not compromised.

**Supplementary information:**

Security measures for detecting unauthorised access can be security personnel, video surveillance or anti-burglary systems.

### PS-03.03B

The outer doors, windows and other construction elements exhibit an appropriate security level so that their combined resistance time withstand a break-in attempt for at least ten minutes in total. This time period applies from the moment an external intruder is detected (e.g. by perimeter surveillance).

**Supplementary information (on 03B, 04B):**

The resistance class RC4 according to DIN EN 1627 stipulates that doors, windows and other components shall withstand a break-in attempt for at least ten minutes. The US standard SD-STD-01.01 Rev.G. is an international equivalent to this standard. However, fulfilling the objective of this criteria does not necessarily imply that those standards have to be fulfilled.

Additionally, the subcriterion demands that all construction elements as a whole lead to a resistance time to break-in attempts for at least ten minutes. Consequently, it does not necessarly demand that all individual construction elements have to fulfil this requirement on their own, provided the combined measures effectively delay an external attack for the required time.

### PS-03.04B

The surrounding wall constructions as well as the locking mechanisms meet the associated requirements.

### PS-03.05B

If the construction elements as a whole do not fully meet the associated requirements, compensating controls are implemented to restore the appropriate security level.

**Supplementary information:**

Compensating measures can include additional security layers (e.g. security areas) on the premise, an increased presence of security personnel, video surveillance and anti-burglary systems.

### PS-03.06B

Data centre personnel are trained on how to respond effectively to unauthorised ingress or egress attempts.

## Additional criterion

### PS-03.01AC (additional, complementing)

The security measures installed at the site include permanently present security personnel (at least two individuals), video surveillance and anti-burglary systems.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Removed specification the the detection of unauthorised access is to occur in a timely manner.

Modified requirements regarding the construction element's ability to withstand a burglary attempt so that the construction elements need to meet the associated requirements as a whole, and compensating controls can be implemented if they cannot do so.

Added requirement for the training of data centre personnel.

**Additional criterion:**

No change.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.