PS-05 Protection against Threats from Outside and from the Environment
Changed since C5:2020
Basic criterion
Extended criterion to address not just fire and smoke, but also lightning and unwanted water.
Added further structural measures to address threats from outside and from the environment.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Additional criterion removed.
Wording in C5:2020
Basic criterion
Premises and buildings related to the cloud service provided are protected from fire and smoke by structural, technical and organisational measures that meet the security requirements of the Cloud Service Provider (cf. PS-01 Security Concept) and include the following aspects:
a) Structural Measures:
Establishment of fire sections with a fire resistance duration of at least 90 minutes for all structural parts.
b) Technical Measures:
- Early fire detection with automatic voltage release. The monitored areas are sufficiently fragmented to ensure that the prevention of the spread of incipient fires is proportionate to the maintenance of the availability of the cloud service provided;
- Extinguishing system or oxygen reduction; and
- Fire alarm system with reporting to the local fire department.
c) Organisational Measures
- Regular fire protection inspections to check compliance with fire protection requirements; and
- Regular fire protection exercises.
Additional criterion
The environmental parameters are monitored. When the permitted control range is exceeded, alarm messages are generated and forwarded to the Cloud Service Provider’s subject matter experts
Basic criterion
Premises and buildings related to the cloud service provided are protected from fire, smoke, lightning and unwanted water by structural, technical and organisational measures that meet the security requirements of the cloud service provider (cf. PS-01).
Structural Measures include the following aspects:
- Establishment of fire sections with a fire resistance duration of at least 90 minutes for all structural parts, or alternatively, equivalent organisational and technical measures that ensure the same level of protection standard as 90-minutes fire-resistant structural parts or establishment of compensating measures for containing fires and maintaining operational capability. If compensating measures are taken into account, the fire resistance of structural parts has to be at least 60 minutes;
- Effective implementation of measures to protect against lightning and overvoltage damage; and
- Effective implementation of measures to protect against flooding, unless critical facilities are located significantly above the highest flood level at the location of the cloud data centre. Additionally, appropriate measures to mitigate the effects of heavy rain are implemented, unless critical facilities are located significantly above the backwater level at the location of the cloud data centre.
Supplementary information
Structural parts are walls, ceilings, floors, doors, windows and other breakthroughs like ventilation flaps, etc.
Compensating measures can take into account aspects such as:
- Partitioning and layout of fire sections;
- Extinguishing systems within the fire sections;
- Early and very early fire detection mechanisms;
- Redundancy of systems and supply facilities within the premise; and
- Period of time the locations and premises can withstand a fire impairing a data hall without a second data hall catching fire.
The cloud service provider should describe the measures taken to protect its premises and buildings against fire as part of the system description.
The location of all critical facilities in relation to the highest historically recorded flood level at the cloud data centre site or the site's backwater level acts as the starting point for considering flood and heavy rain protection measures.
Technical Measures include the following aspects:
- Early fire detection with automatic voltage release. The monitored areas are sufficiently fragmented to ensure that the prevention of the spread of incipient fires is proportionate to the maintenance of the availability of the cloud service provided;
- Extinguishing system or oxygen reduction; and
- Fire alarm system with reporting to the local fire department.
Supplementary information
The monitoring of the environmental parameters is addressed in PS-07. When exceeding the allowed control range, alarm messages are generated and forwarded to the responsible cloud service provider.
Organisational Measures include the following aspects:
- Regular fire protection inspections to check compliance with fire protection requirements; and
- Regular fire protection exercises.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources