BSI C5:2020·Criterion OPS-19·high·Component: Operations Security

What this control requires

Conducts annual penetration tests by qualified personnel on critical system components per risk analysis. Assesses findings' severity and remediates medium/high risks within defined timelines, protecting cloud customer data from identified vulnerabilities.
— BSI C5:2020, Criterion OPS-19

In plain English

Conducts annual penetration tests by qualified personnel on critical system components per risk analysis. In practice, this means you can prove you risk cloud customer data-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Operations Security, the assessor will trace your implementation back to the catalogue reference (Criterion OPS-19) and look for objective evidence on the latest two assessment cycles.

How to implement

Vulnerability Management

Scanners. Pair an unauthenticated scanner (Nessus / Qualys / Tenable.io) for external surface with an authenticated agent for OS/library CVEs on every host.

SLA. Document remediation SLAs by CVSS / EPSS: critical 7 days, high 30 days, medium 90 days; report monthly trend to leadership.

Containers. Scan images in CI (Trivy / Grype / Snyk Container) AND at runtime; block deploys on critical findings without exception.

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Code Review Testing

Pipeline. Require at least one human reviewer plus passing CI (lint, type, unit, security scan) before merge — protected branches enforce this.

Operational checklist

  • Risk. Document the trigger, the owner and the cadence.
  • Review. Document the trigger, the owner and the cadence.
  • Security. Document the trigger, the owner and the cadence.
  • Data. Document the trigger, the owner and the cadence.
  • Scope: cloud customer data, management.

Evidence to collect

  • Vapt Scan. vapt_scan evidence

Pen-test and vulnerability scan reports substantiate attack-surface coverage. Focus: Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests.

Common pitfalls

  • Scans that hit only the perimeter; missing authenticated scans of OS, runtime libs and base images so most CVEs are invisible.
  • Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

Related controls in BSI C5:2020

References

Topics: governance riskvulnerability managementcloud posturecode review testing