BSI C5:2020 PS-01 — Physical Security and Environmental Control Requirements

What this control requires

Documents security requirements for premises per SP-01, addressing risks like unauthorized access, fire, and power failure based on risk assessments. Ensures data center compliance with technical standards and verifies third-party facilities to protect cloud infrastructure.

In plain English

Documents security requirements for premises per SP-01, addressing risks like unauthorized access, fire, and power failure based on risk assessments. In practice, this means you can prove you risk management-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Physical Security, the assessor will trace your implementation back to the catalogue reference (Criterion PS-01) and look for objective evidence on the latest two assessment cycles.

How to implement

Physical Security

Inheritance. For cloud-only operations, inherit physical controls from the provider's SOC 2 / ISO 27001 report and document the inheritance in the SoA.

Operational checklist

• Risk. Document the trigger, the owner and the cadence.
• Security. Document the trigger, the owner and the cadence.
• Physical. Document the trigger, the owner and the cadence.
• Data. Document the trigger, the owner and the cadence.
• Access. Document the trigger, the owner and the cadence.
• Scope: management.

Evidence to collect

• Vendor Risk Management. vendor_risk_management evidence
• Policy Document. A signed and version-controlled policy / standard / procedure document.
• Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Signed policy or standard documents the safeguard. Focus: Physical Security and Environmental Control Requirements.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• ISO/IEC 27001:2022 A.5.19 — Information security in supplier relationships
• SOC 2 (2017 TSC) CC9.2 — Vendor Risk Management
• ISO/IEC 27701:2025 A.3.10 — Supplier agreements
• CIS Controls v8 3.8 — Document Data Flows
• NIST SP 800-171 Rev. 3 3.16.2 — Unsupported System Components

Related controls in BSI C5:2020

• Criterion COS-02 — Security requirements for connections in the Cloud Service Provider's network
• Criterion SSO-01 — Policies and instructions for controlling and monitoring third parties
• Criterion OIS-03 — Interfaces and Dependencies
• Criterion SSO-02 — Risk assessment of service providers and suppliers
• Criterion OIS-07 — Application of the Risk Management Policy
• Criterion COS-03 — Monitoring of connections in the Cloud Service Provider's network

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion PS-01

Topics: governance riskphysical securityvendor riskvendor managementenvironmental controlssupply chain security