PSS · Product Safety and Security
PSS-06 Session Management
Changed since C5:2020
Basic criterion
Replaced requirement for session management that complies with the state of the art with requirement for session management that complies with the established rules of technology.
Wording in C5:2020
Basic criterion
To protect confidentiality, availability, integrity and authenticity during interactions with the cloud service, a suitable session management system is used that at least corresponds to the state-of-the-art and is protected against known attacks. Mechanisms are implemented that invalidate a session after it has been detected as inactive. The inactivity can be detected by time measurement. In this case, the time interval can be configured by the Cloud Service Provider or - if technically possible - by the cloud customer.
Basic criterion
To protect confidentiality, availability, integrity and authenticity during interactions with the cloud service, a suitable session management system is used that corresponds to the established rules of technology and is protected against known attacks.
Supplementary information
Known attacks include manipulation, forgery, session takeover, Denial of Service attacks, enveloping, replay and null cipher attacks.
Mechanisms are implemented that invalidate a session after it has been detected as inactive. The inactivity can be detected by time measurement. In this case, the time interval can be configured by the cloud service provider or - if technically possible - by the cloud service customer.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers can use appropriate controls to ensure that they are using the session management protection features of the cloud service in accordance with their own ISMS. They also set the time period after which a session becomes invalid according to their own ISMS specifications.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources