PSS · Product Safety and Security
PSS-02 Identification of Vulnerabilities of the Cloud Service
Changed since C5:2020
Basic criterion
Extended the activities to be covered by the procedures by conducting security checks based on a list of software components or SBOM.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
No change.
Wording in C5:2020
Basic criterion
The Cloud Service Provider applies appropriate measures to check the cloud service for vulnerabilities which might have been integrated into the cloud service during the software development process.
The procedures for identifying such vulnerabilities are part of the software development process and, depending on a risk assessment, include the following activities:
- Static Application Security Testing;
- Dynamic Application Security Testing;
- Code reviews by the Cloud Service Provider's subject matter experts; and
- Obtaining information about confirmed vulnerabilities in software libraries provided by third parties and used in their own cloud service.
The severity of identified vulnerabilities is assessed according to defined criteria and measures are taken to immediately eliminate or mitigate them.
Additional criterion
The procedures for identifying such vulnerabilities also include annual code reviews or security penetration tests by qualified external third parties.
Supplementary information on all sub-criteria
Known vulnerabilities in externally related system components (e.g. operating systems) used for the development and provision of the cloud service but not going through the cloud service provider's software development process are the subject of criterion OPS-25 (Managing Vulnerabilities, Incidents and Errors - Vulnerability Scans).
Basic criterion
The cloud service provider applies appropriate measures to check the cloud service for vulnerabilities which might have been integrated into the cloud service during the software development process.
The procedures for identifying such vulnerabilities are part of the software development process and, depending on a risk assessment, include the following activities:
- Static Application Security Testing;
- Dynamic Application Security Testing;
- Code reviews by the cloud service provider's subject matter experts;
- Conducting security checks based on a list of software components or Software Bill of Materials (SBOM); and
- Obtaining information about confirmed vulnerabilities in software libraries provided by third parties and used in their own cloud service.
The severity of identified vulnerabilities is assessed according to defined criteria and measures are taken to immediately eliminate or mitigate them.
Additional criterion
PSS-02.01AC
Additional, complementingThe procedures for identifying such vulnerabilities also include annual code reviews or security penetration tests by qualified external third parties.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources