# PSS-04 Error handling and Logging Mechanisms

- Domain: PSS – Product Safety and Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/pss-04/

**Supplementary information:**

Unlike the additional criterion OPS-15, which covers both, system components under the responsibility of the cloud service provider, as well as system components under the responsibility of the cloud service customer, the scope of this criterion is limited strictly to system components under the responsibility of the cloud service customer only.

The extent of the logging depends on the cloud service. There may therefore be cloud services, such as SaaS services for which the amount of system components under the responsibility of the cloud service customer is very limited, to which this criterion is not applicable.

## Basic criterion

### PSS-04.01B

The cloud service provided is equipped with error handling and logging mechanisms for system components under the responsibility of the cloud service customer. These enable cloud service customers to obtain security-related information about the security status of the cloud service as well as the data, services or functions it provides.

### PSS-04.02B

These mechanisms are designed to address identified security risks related to the use of the cloud service. The cloud service provider identifies and documents these risks in advance, ensuring that the implemented logging mechanisms capture relevant events and activities.

### PSS-04.03B

The information is detailed enough to allow cloud service customers to check the following aspects, insofar as they are applicable to the cloud service:

1. Which cloud service customer data and cloud service derived data, services or functions available to the cloud service customer within the cloud service, have been accessed by whom, when and from where (Audit Logs);
2. Malfunctions during processing of automatic or manual actions; and
3. Changes to security-relevant configuration parameters, error handling and logging mechanisms, user authentication, action authorisation, cryptography, and communication security.

### PSS-04.04B

The logged information is protected from unauthorised access and modification and can be deleted by the cloud service customer.

**Supplementary information:**

The deletion of the logged information by the cloud service customer can, for example, be implemented by providing the cloud service customer with a process to request this deletion.

### PSS-04.05B

Where applicable, the cloud service customer can activate or de-activate the logging and can control the scope and verbosity of the logging the cloud service provides.

### PSS-04.06B

The logging of management plane actions by the cloud service customers covers all relevant systems and system components.

## Additional criterion

### PSS-04.01AC (additional, complementing)

Cloud service customers can retrieve security-related information via documented interfaces which are suitable for further processing this information as part of their Security Information and Event Management (SIEM).

## Complementary customer criteria

If the cloud service is equipped with error handling and logging mechanisms, cloud service customers must activate these and configure them according to defined requirements. The cloud service customer must incorporate his own information security management for this purpose.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Added requirement for error handling and logging mechanisms to address identified security risks.

Rephrased requirement for the cloud service customer being able to activate the logging and configure its type and scope.

Added requirement regarding the scope of the management plane action logging.

Bullet points are now sorted to ease discussions about specific list items.

**Additional criterion:**

No change.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.