BSI C5:2020 OPS-05 — Protection Against Malware - Implementation

What this control requires

Configures system components with daily-updated malware protection programs using signature and behavior-based detection. Ensures effective mitigation of malware threats, protecting cloud customer data processed in the production environment from compromise.

In plain English

Configures system components with daily-updated malware protection programs using signature and behavior-based detection. In practice, this means you can prove you risk protection-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Operations Security, the assessor will trace your implementation back to the catalogue reference (Criterion OPS-05) and look for objective evidence on the latest two assessment cycles.

How to implement

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

• Risk. Document the trigger, the owner and the cadence.
• Security. Document the trigger, the owner and the cadence.
• Protection. Document the trigger, the owner and the cadence.
• Data. Document the trigger, the owner and the cadence.
• Policy. Document the trigger, the owner and the cadence.
• Scope: protection, against malware - implementation, cloud customer data, management.

Evidence to collect

• Policy Document. A signed and version-controlled policy / standard / procedure document.

Signed policy or standard documents the safeguard. Focus: Protection Against Malware - Implementation.

Common pitfalls

• Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.
• Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• NIST SP 800-171 Rev. 3 3.13.15 — Session Authenticity
• GDPR Article 72 — Procedure

Related controls in BSI C5:2020

• Criterion OPS-04 — Protection Against Malware - Concept
• Criterion OPS-22 — Testing and Documentation of known Vulnerabilities
• Criterion AM-06 — Asset Classification and Labelling
• Criterion OPS-18 — Managing Vulnerabilities, Malfunctions and Errors - Concept
• Criterion HR-02 — Employment terms and conditions
• Criterion PI-01 — Documentation and safety of input and output interfaces

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion OPS-05

Topics: governance riskcloud posturepolicy management