PSS · Product Safety and Security
PSS-01 Guidelines and Recommendations for Cloud Service Customers
Changed since C5:2020
Basic criterion
Excluded installation of the cloud service from and included implementation of complementary customer controls on the list of aspects in which the published information is supposed to assist.
Extended the list of aspects to be covered by the published information by malware protection for containers or virtual machines, CUECs, encryption mechanisms and services, data leakage prevention, secure development and operation of applications, use and configuration of defensive mechanisms and wide-area distributed architecture mechanisms, methods used for data separation, logging and monitoring, as well as inbound and outbound interfaces.
Added further specification for the information on CUECs to be provided.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
The Cloud Service Provider provides cloud customers with guidelines and recommendations for the secure use of the cloud service provided. The information contained therein is intended to assist the cloud customer in the secure configuration, installation and use of the cloud service, to the extent applicable to the cloud service and the responsibility of the cloud user.
The type and scope of the information provided will be based on the needs of subject matter experts of the cloud customers who set information security requirements, implement them or verify the implementation (e.g. IT, Compliance, Internal Audit). The information in the guidelines and recommendations for the secure use of the cloud service address the following aspects, where applicable to the cloud service:
- Instructions for secure configuration;
- Information sources on known vulnerabilities and update mechanisms;
- Error handling and logging mechanisms;
- Authentication mechanisms;
- Roles and rights concept including combinations that result in an
elevated risk; and
- Services and functions for administration of the cloud service by privileged users.
The information is maintained so that it is applicable to the cloud service provided in the version intended for productive use.
Basic criterion
The cloud service provider publishes guidelines and recommendations for cloud service customers regarding the secure use of the cloud service provided. The information contained therein is intended to assist the cloud service customer in the secure configuration and use of the cloud service, as well as the implementation of complementary customer controls, to the extent applicable to the cloud service and the responsibility of the cloud service customer.
Supplementary information
In a cloud environment, security responsibilities are shared between the cloud service provider and the customer, varying by service type — Infrastructure as a Service (IaaS), Platform as a Service (PaaS), or Software as a Service (SaaS). Guidance on the complementary customer controls helps cloud service customers understand their roles and responsibilities within the Shared Responsibility Model, also in terms of security and operational management (cf. OIS-03). By offering detailed guidance, cloud service customers are equipped to understand and implement the necessary controls that fall under their responsibility. The level of detail and length can vary according to the type of cloud service provided.
Examples for defensive mechanisms include payload filtering, traffic shaping, load balancing, load shedding and DDoS defences.
Examples for wide-area distributed architecture mechanisms include fault tolerance through replication, avoidance of localised outages and disasters through the use of multiple cloud regions, as well as the reduction of user-facing latency through the geo-dispersion of service endpoints.
The type and scope of the information in the guidelines and recommendations for the secure use of the cloud service provided will be based on the needs of subject matter experts of the cloud service customers who set information security requirements, implement them or verify the implementation (e.g. IT, Compliance, Internal Audit). The information in the guidelines and recommendations for the secure use of the cloud service address the following aspects, where applicable to the cloud service:
- Procedures for secure configuration;
- Information sources on known vulnerabilities and update mechanisms;
- Malware protection for containers or virtual machines;
- Error handling and logging mechanisms;
- Authentication mechanisms;
- Roles and rights framework including combinations that result in an elevated risk;
- Services and functions for administration of the cloud service by privileged users;
- Complementary user entity controls;
- Encryption mechanisms and services;
- Data leakage prevention;
- Secure application development and operation on the cloud service;
- Instructions for using and configuring defensive mechanisms;
- Instructions for using and configuring wide-area distributed architecture mechanisms;
- Methods used for client data separation (cf. OPS-30 and OPS-31);
- How information security risks related to the use of the cloud service can be addressed through proper logging and monitoring mechanisms; and
- Inbound and outbound interfaces through which the cloud service can be accessed by other cloud services or IT systems of cloud service customers (cf. PI-01).
The cloud service provider describes in the user documentation all necessary complementary user entity controls (CUECs) and corresponding explanations of them, so that the cloud service customer has sufficient information for appropriate risk management on its side.
The above-mentioned information is maintained so that it is applicable to the cloud service provided in the version intended for productive use.
Additional criterion
PSS-01.01AC
Additional, complementingThe cloud service provider notifies cloud service customers in a timely manner about any planned modifications to the cloud service so that the affected cloud service customers can react appropriately with organisational and technical measures before the changes take effect.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the cloud service provider's information is used to derive policies, frameworks and measures for the secure configuration and use (according to their own risk assessment) of the cloud service. Compliance with these policies, frameworks and measures is checked. Changes to the information are timely assessed for their impact on these documents and any necessary changes are implemented.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources