PS-06 Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities
Changed since C5:2020
Basic criterion
Restructured the list of aspects to be covered by the security requirements to be two lists instead.
Moved requirement about the implementation of UPSes and EPSes complying with SLAs from the additional criterion to the basic criterion.
Added requirement for protecting data on equipment that is shared with third parties.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Moved requirement for the implementation of UPSes and EPSes complying with SLAs from the additional criterion to the basic criterion.
Modified specification regarding the design of the cooling supply system to be more goal-oriented.
Added requirements regarding the conditions for installation, maintenance and servicing of the related technical equipment, as well as the maintenance agreements.
Wording in C5:2020
Basic criterion
Measures to prevent the failure of the technical supply facilities required for the operation of system components with which information from cloud customers is processed, are documented and set up in accordance with the security requirements of the Cloud Service Provider (cf. PS-01 Security Concept) with respect to the following aspects:
a) Operational redundancy (N+1) in power and cooling supply
b) Use of appropriately sized uninterruptible power supplies (UPS) and emergency power systems (NEA), designed to ensure that all data remains undamaged in the event of a power failure. The functionality of UPS and NEA is checked at least annually by suitable tests and exercises (cf. BCM-04 - Verification, updating and testing of business continuity).
c) Maintenance (servicing, inspection, repair) of the utilities in accordance with the manufacturer's recommendations.
d) Protection of power supply and telecommunications lines against interruption, interference, damage and eavesdropping. The protection is checked regularly, but at least every two years, as well as in case of suspected manipulation by qualified personnel regarding the following aspects:
- Traces of violent attempts to open closed distributors;
- Up-to-datedness of the documentation in the distribution list;
- Conformity of the actual wiring and patching with the documentation;
- The short-circuits and earthing of unneeded cables are intact; and
- Impermissible installations and modifications.
Additional criterion
Uninterruptible Power Supplies (UPS) and Emergency Power Supplies (NPS) are designed to meet the availability requirements defined in the Service Level Agreement.
The cooling supply is designed in such a way that the permissible operating and environmental parameters are also ensured on at least five consecutive days with the highest outside temperatures measured to date within a radius of at least 50 km around the locations of the premises and buildings, with a safety margin of 3 K (in relation to the outside temperature). The Cloud Service Provider has previously determined the highest outdoor temperatures measured to date (cf. PS-01 Security Concept).
The connection to the telecommunications network is designed with sufficient redundancy so that the failure of a telecommunications network does not impair the security or performance of the Cloud Service Provider.
Basic criterion
Measures to prevent the failure of the technical supply facilities required for the operation of system components with which cloud service customer data is processed and to protect equipment containing cloud service customer data, are documented and set up in accordance with the security requirements of the cloud service provider (cf. PS-01) with respect to the following aspects:
- Operational redundancy (N+1) in power and cooling supply;
- Use of appropriately sized uninterruptible power supplies (UPSes) and emergency power supplies (EPSes), designed to ensure that all data remains undamaged in the event of a power failure. The functionality of UPSes and EPSes is checked at least annually by suitable tests and exercises (cf. BCM-04);
- Maintenance (servicing, inspection, repair) of the utilities in accordance with the manufacturer's recommendations; and
- Protection of power supply and telecommunications lines against interruption, interference, damage and eavesdropping.
Supplementary information
Measures to prevent the failure of the technical supply facilities are e.g. power supply, cooling, fire-fighting technology, telecommunications, security technology, etc.
Cloud service providers can ensure that all data remains undamaged in the event of a power failure by shutting down servers following a defined procedure.
Power supply and telecommunications lines can be protected against interruption, interference, damage and eavesdropping by e.g. underground supply via different supply routes.
Uninterruptible Power Supplies (UPSes) and Emergency Power Supplies (EPSes) are implemented to comply with the availability requirements defined in the Service Level Agreement.
The protection of power supply and telecommunications lines is checked regularly, but at least every two years as well as in case of suspected manipulation, by qualified personnel regarding the following aspects:
- Traces of violent attempts to open closed distributors;
- Up-to-dateness of the documentation within the distributor;
- Conformity of the actual wiring and patching with the documentation;
- The short-circuits and earthing of unneeded cables and wires are intact; and
- Impermissible installations and modifications.
Supplementary information
The subcriterion requires the check to be performed at least every two years. If no check was performed during the specified period of a Type 2 engagement, the auditor shall note in the test result that there was 'no occurrence' provided that the previous check was performed within the two years required by the criterion. For the evaluation of the design of the control, the auditor may obtain evidence regarding the previous check, even if this check did not occur within the specified period of the engagement. If there was no check performed for two years, the auditor shall note a deviation.
Additional criterion
PS-06.01AC
Additional, complementingThe cooling supply system is designed in such a way that the permissible operating and environmental parameters are also ensured on at least five consecutive days with the highest outside temperatures that can reasonably be estimated to occur at the locations of the premises and buildings within the lifespan of the cooling supply system, with an appropriate safety margin.
Supplementary information
This subcriterion demands the implementation of concrete measures to fulfil the policy required by PS-01.03AC. The cloud service provider also determines the highest outside temperatures that can reasonably be estimated to occur at the locations of the premises and buildings within the lifespan of the cooling supply system as part of PS-01.03AC.
PS-06.02AC
Additional, complementingThe connection to the telecommunications network is designed with sufficient redundancy so that the failure of a telecommunications network does not impair the security or performance of the cloud service provider.
PS-06.03AC
Additional, complementingThe cloud service provider implements measures to ensure the compatibility of the conditions for installation, maintenance and servicing of the related technical equipment (e.g., electrical power, air conditioning, fire protection) with the cloud service's availability and security requirements.
PS-06.04AC
Additional, complementingThe cloud service provider ensures that maintenance agreements for equipment used for the hosting of the cloud service enable the timely installation of security updates on this equipment.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources