BSI C5:2020·Criterion OPS-15·high·Component: Operations Security

What this control requires

Generates log data enabling tenant-level user access identification for forensic analysis. Provides interfaces for backups and network communication analysis, supporting incident response and ensuring accountability for cloud customer data security.
— BSI C5:2020, Criterion OPS-15

In plain English

Generates log data enabling tenant-level user access identification for forensic analysis. In practice, this means you can prove you interfaces - accountability-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Operations Security, the assessor will trace your implementation back to the catalogue reference (Criterion OPS-15) and look for objective evidence on the latest two assessment cycles.

How to implement

Incident Response

Runbook. Maintain a runbook keyed by incident type with named roles (IC, comms, scribe), an out-of-band comms channel, and a 72-hour timeline for external notification.

Tabletop. Run a quarterly tabletop exercise (ransomware, insider, supply-chain) and feed gaps back into the runbook.

Logging Monitoring

AWS. Org-trail CloudTrail to a central log archive account, GuardDuty in every region, and Security Hub for cross-source correlation.

Azure. Pipe every diagnostic setting into a central Log Analytics workspace; onboard Microsoft Sentinel for SIEM/SOAR.

GCP. Aggregate audit logs in a dedicated logging project with sink to BigQuery; enable Security Command Center Premium and route findings to Chronicle SIEM.

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Operational checklist

  • Interfaces. Document the trigger, the owner and the cadence.
  • Security. Document the trigger, the owner and the cadence.
  • Data. Document the trigger, the owner and the cadence.
  • Access. Document the trigger, the owner and the cadence.
  • Identification. Document the trigger, the owner and the cadence.
  • Scope: - accountability, cloud customer data, management.

Evidence to collect

  • Ticketing Workflow. ticketing_workflow evidence
  • Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Logging and Monitoring - Accountability.

Common pitfalls

  • Runbooks that name a role but no person, or list a paging channel that no longer exists.
  • Per-account logging that nobody stitches together at the org level — incidents that cross accounts go undetected for days.
  • Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

Related controls in BSI C5:2020

References

Topics: logging monitoringincident responsechange managementcloud posture