BSI C5:2020 OPS-06 — Data Protection and Recovery - Concept

What this control requires

Documents data backup and recovery policies per SP-01, aligning with customer agreements and RTO/RPO requirements. Specifies encrypted backups, authorized access, and recovery testing to ensure data availability and integrity for cloud customers.

In plain English

Documents data backup and recovery policies per SP-01, aligning with customer agreements and RTO/RPO requirements. In practice, this means you can prove you risk agreements-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated critical in the source catalogue. Treat gaps here as production incidents in the risk register, not housekeeping.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Operations Security, the assessor will trace your implementation back to the catalogue reference (Criterion OPS-06) and look for objective evidence on the latest two assessment cycles.

How to implement

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Code Review Testing

Pipeline. Require at least one human reviewer plus passing CI (lint, type, unit, security scan) before merge — protected branches enforce this.

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

• Risk. Document the trigger, the owner and the cadence.
• Review. Document the trigger, the owner and the cadence.
• Security. Document the trigger, the owner and the cadence.
• Protection. Document the trigger, the owner and the cadence.
• Data. Document the trigger, the owner and the cadence.
• Scope: agreements, protection, - concept, business continuity, management.

Evidence to collect

• Policy Document. A signed and version-controlled policy / standard / procedure document.
• Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Signed policy or standard documents the safeguard. Focus: Data Protection and Recovery - Concept.

Common pitfalls

• Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.
• Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• SOC 2 (2017 TSC) A1.3 — Testing of System Recovery Procedures
• NIST SP 800-53 Rev. 5 CP-9(1) — Testing For Reliability And Integrity
• ISO/IEC 27001:2022 A.8.33 — Test information
• NIST SP 800-171 Rev. 3 3.13.15 — Session Authenticity

Related controls in BSI C5:2020

• Criterion OPS-08 — Data Backup and Recovery - Regular Testing
• Criterion BCM-03 — Planning business continuity
• Criterion OPS-07 — Data Backup and Recovery - Monitoring
• Criterion BCM-04 — Verification, updating and testing of the business continuity
• Criterion OPS-22 — Testing and Documentation of known Vulnerabilities
• Criterion OPS-09 — Data Backup and Recovery - Storage

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion OPS-06

Topics: governance riskdata protectionbusiness continuitybackup recoverycloud posturecode review testingpolicy management