# BSI C5 OPS-02 — Capacity Management - Monitoring

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_bsic5_ops02_d387dca7af-bsi-c5-ops-02-capacity-management-monitoring
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [BSI C5 (German Cloud)](https://support.icompaas.com/support/solutions/c_gen_bsi_c5) › [Operations Security](https://support.icompaas.com/support/solutions/folders/f_gen_cgenbsic5_operationssecurity)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

BSI C5 · Control OPS-02 · Priority: high · Component: Operations Security

### What this control covers

Defines safeguards for monitoring and provisioning cloud services to ensure compliance with service level agreements. Tracks resource allocation to prevent performance degradation, maintaining availability and integrity of cloud customer data and services.

### Why it matters

You cannot investigate or attest what you did not log. This control underpins every incident-response capability and is what auditors will sample from for control operating effectiveness.

### How to implement

#### AWS

Turn on a **multi-region, organisation-wide CloudTrail** trail with log-file validation and ship to a dedicated, write-once **log archive account**. Enable **CloudTrail Lake** or stream to OpenSearch/Splunk for search. Pair with **GuardDuty**, **Security Hub**, and **VPC Flow Logs**.

#### Azure

Send **Activity logs** + diagnostic logs from every subscription to a central **Log Analytics workspace**. Stand up **Microsoft Sentinel** for SIEM/SOAR with the Azure, M365 and IdP connectors and pre-built analytics rules.

#### GCP

Centralize via **Cloud Logging** log sinks at the org level to a **locked log bucket** with 7-year retention. Use **SCC Premium** for posture findings and **Chronicle** for SIEM correlation.

#### Google Workspace

Forward the **Admin, Login, Drive, Token and Mobile** audit logs to Cloud Logging (Workspace BigQuery export). Alert on impossible-travel logins, OAuth-scope grants for high-risk scopes, and external Drive sharing of sensitive labels.

#### GitHub

Stream the **Enterprise audit log** to your SIEM and enable **Audit Log API** alerting on key events: owner changes, IP allowlist edits, secret deletions, repo visibility flips.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Capacity Management - Monitoring.

### Quick checklist

-   Security — Agreements / - Configuration
-   Capacity — Agreements / - Configuration
-   Data — Agreements / - Configuration

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [Ensure every Security Group is being used by at least one resource](https://support.icompaas.com/support/solutions/articles/62000129468-ensure-every-security-group-is-being-used-by-at-least-one-resource)
-   [2.11 Ensure that 'Automatic provisioning of monitoring agent' is set to 'On'](https://support.icompaas.com/support/solutions/articles/62000219761-2-11-ensure-that-automatic-provisioning-of-monitoring-agent-is-set-to-on-)
-   [2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected](https://support.icompaas.com/support/solutions/articles/62000219760-2-10-ensure-that-microsoft-cloud-app-security-mcas-integration-with-security-center-is-selected)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.