# PSS-11 Images for Virtual Machines and Containers

- Domain: PSS – Product Safety and Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/pss-11/

## Basic criterion

### PSS-11.01B

If cloud service customers operate virtual machines or containers with the cloud service, the cloud service provided is equipped with functionalities that ensure the following aspects:

1. Cloud service customers can restrict the selection of images of virtual machines or containers according to their specifications, so that users of the cloud service customer can only launch the images or containers released according to these restrictions;
2. If the cloud service provider provides images of virtual machines or containers to the cloud service customer, the cloud service provider appropriately informs the cloud service customer of the changes made to the previous version;
3. Images provided by the cloud service provider are labelled with information regarding their origin; and
4. Images provided by the cloud service provider are hardened according to generally accepted industry standards.

**Supplementary information:**

This criterion is typically not applicable to the SaaS service model.

Generally accepted industry standards are, for example, the Security Configuration Benchmark of the Centre for Internet Security (CIS) or the corresponding modules in the BSI IT-Grundschutz-Compendium.

## Additional criterion

### PSS-11.01AC (additional, complementing)

The cloud service provider checks the integrity and authenticity of virtual machines or container images at startup and informs the cloud service customer accordingly about the results of those checks.

**Supplementary information:**

Typical measures for checking virtual machines or container images against integrity and authenticity include cryptographical signing.

### PSS-11.02AC (additional, complementing)

During runtime, the cloud service provider protects the virtual machines or container images against tampering and informs the cloud service customer accordingly about the status during runtime.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that the images of virtual machines or containers they operate with the cloud service comply with their information security management requirements and that the results of the integrity checks at startup and at runtime are processed according to these requirements.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Extended aspects to be covered by the equipped functionalities by images being labelled with information about their origin.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.