# PSS-06 Session Management

- Domain: PSS – Product Safety and Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/pss-06/

## Basic criterion

### PSS-06.01B

To protect confidentiality, availability, integrity and authenticity during interactions with the cloud service, a suitable session management system is used that corresponds to the established rules of technology and is protected against known attacks.

**Supplementary information:**

Known attacks include manipulation, forgery, session takeover, Denial of Service attacks, enveloping, replay and null cipher attacks.

### PSS-06.02B

Mechanisms are implemented that invalidate a session after it has been detected as inactive. The inactivity can be detected by time measurement. In this case, the time interval can be configured by the cloud service provider or - if technically possible - by the cloud service customer.

## Complementary customer criteria

Cloud service customers can use appropriate controls to ensure that they are using the session management protection features of the cloud service in accordance with their own ISMS. They also set the time period after which a session becomes invalid according to their own ISMS specifications.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Replaced requirement for session management that complies with the state of the art with requirement for session management that complies with the established rules of technology.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.