PSS · Product Safety and Security
PSS-04 Error handling and Logging Mechanisms
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Added requirement for error handling and logging mechanisms to address identified security risks.
Rephrased requirement for the cloud service customer being able to activate the logging and configure its type and scope.
Added requirement regarding the scope of the management plane action logging.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
No change.
Wording in C5:2020
Basic criterion
The cloud service provided is equipped with error handling and logging mechanisms. These enable cloud users to obtain security-related information about the security status of the cloud service as well as the data, services or functions it provides.
The information is detailed enough to allow cloud users to check the following aspects, insofar as they are applicable to the cloud service:
- Which data, services or functions available to the cloud user within the cloud service, have been accessed by whom and when (Audit Logs);
- Malfunctions during processing of automatic or manual actions; and
- Changes to security-relevant configuration parameters, error handling and logging mechanisms, user authentication, action authorisation, cryptography, and communication security.
The logged information is protected from unauthorised access and modification and can be deleted by the Cloud Customer.
If the cloud customer is responsible for the activation or type and scope of logging, the Cloud Service Provider must provide appropriate logging capabilities.
Additional criterion
Cloud users can retrieve security-related information via documented interfaces which are suitable for further processing this information as part of their Security Information and Event Management (SIEM).
Supplementary information on all sub-criteria
Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited strictly to system components under the responsibility of the cloud service customer only.
The extent of the logging depends on the cloud service. There may therefore be cloud services, such as SaaS services for which the amount of system components under the responsibility of the cloud service customer is very limited, to which this criterion is not applicable.
Basic criterion
The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud service customers to obtain security-related information about the security status of the cloud service as well as the data, services or functions it provides.
These mechanisms are designed to address identified security risks related to the use of the cloud service. The cloud service provider identifies and documents these risks in advance, ensuring that the implemented logging mechanisms capture relevant events and activities.
The information is detailed enough to allow cloud service customers to check the following aspects, insofar as they are applicable to the cloud service:
- Which cloud service customer data and cloud service derived data, services or functions available to the cloud service customer within the cloud service, have been accessed by whom, when and from where (Audit Logs);
- Malfunctions during processing of automatic or manual actions; and
- Changes to security-relevant configuration parameters, error handling and logging mechanisms, user authentication, action authorisation, cryptography, and communication security.
The logged information is protected from unauthorised access and modification and can be deleted by the cloud service customer.
Supplementary information
The deletion of the logged information by the cloud service customer can, for example, be implemented by providing the cloud service customer with a process to request this deletion.
Where applicable, the cloud service customer can activate or de-activate the logging and can control the scope and verbosity of the logging the cloud service provides.
The logging of management plane actions by the cloud service customers covers all relevant systems and system components.
Additional criterion
PSS-04.01AC
Additional, complementingCloud service customers can retrieve security-related information via documented interfaces which are suitable for further processing this information as part of their Security Information and Event Management (SIEM).
Complementary customer criteria
What cloud service customers implement on their side.
If the cloud service is equipped with error handling and logging mechanisms, cloud service customers must activate these and configure them according to defined requirements. The cloud service customer must incorporate his own information security management for this purpose.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources