C5 PS: physical security with colocation and hyperscalers

Last updated: 2026-11-06

This page covers the PS (Physical Security) domain of C5:2026, section 5.5 of the catalogue. How criteria and subcriteria are structured in general is explained on the page C5 criteria catalogue. You run the data centre yourself and offer IaaS or colocation? The operator’s view is shown on the page Data centre and hosting; this page is about providers who rent space or use a platform.

What is the PS domain about?

PS protects the buildings and premises in which the service runs. The catalogue states the objective of preventing unauthorised physical access and protecting against theft, damage, loss and outage of operations (section 5.5). The criteria require concrete values: at least two locations at an adequate distance from each other (PS-02.01B), construction elements whose combined resistance withstands a break-in attempt for at least ten minutes (PS-03.03B), revocation of access authorisations after two months without use (PS-04.01B), fire sections with a fire resistance duration of at least 90 minutes or equivalent measures (PS-05.02B), operational redundancy N+1 in power and cooling supply, and UPSes and emergency power supplies tested annually (PS-06.01B).

The domain comprises eight criteria, PS-01 to PS-08, with 28 basic subcriteria, 2 sharpening and 10 complementing additional subcriteria. According to the change history, PS-08 on workplace security is new compared with C5:2020. PS-01 to PS-07 apply to data centres and server rooms in which customer data is processed, including the locations for backup and redundancy and the technical utilities. According to the supplementary information on PS-01, offices and server rooms in which no customer data is processed or stored fall under PS-08.

Starting point: own servers in colocation, backups at a hyperscaler

Fictitious example, not a client. A provider runs a platform with which emergency medical services document their call-outs and transmit them to the receiving hospitals. Production runs on the provider’s own servers in rented, lockable rack cages in two colocation data centres in different cities in Germany; the backups are stored encrypted in the object storage of a large cloud provider. The office has a small server room with test and development systems. A district authority requires a C5 type 2 report.

Before the project, the situation looks like this:

Both data centre operators hold ISO 27001 certificates; nobody has requested their audit reports.
For the cages, each operator keeps a list of the persons with access. It still includes an administrator who has left and a service provider who has not been on site for a year.
Switching between the two locations was tested once during setup and not since.
For troubleshooting, extracts of real call-out data are occasionally copied to the test systems in the office.

Who is responsible for what: provider, platform, customer?

According to section 3.4.6, where data centres are operated by third parties it is generally to be assumed that a subservice organisation relationship exists, in particular for the criteria on physical security. This applies to colocation as much as to the infrastructure of a hyperscaler; the supplementary information on PS-01.05B explicitly names server housing, colocation and IaaS as examples of premises operated by third parties. In our classification, pure colocation is not itself a cloud service, because the definition in the catalogue requires self-service provisioning (section 1.2); according to the BSI FAQ, something that is not a cloud service cannot be the subject of a C5 audit of its own, but it can be considered in the audit of a cloud service. For you as the party renting the space, this means: the operator implements the building controls, and you describe and monitor them as complementary subservice organisation controls (CSOC), that is, the controls you assume at the subservice organisation; hardware and operation of the servers in the cage remain with you. The provider chooses whether to have the subservice organisation’s controls audited as well (inclusive method) or to exclude them (carve-out method); the basics are on the page C5 scope. Our classification for the example:

Aspect	Provider	Platform (subservice organisation)	Customer (emergency medical service, district)
Building, perimeter, fire protection, utilities, environmental monitoring in the data centres (PS-03, PS-05, PS-06, PS-07)	describes the expected CSOC and verifies their implementation (PS-01.05B, PS-01.06B)	colocation operator and hyperscaler implement the controls; outside the audit with the carve-out method	-
Access to the rack cages (PS-04)	decides who among its own staff and service providers gets access, and has authorisations revoked	colocation operator runs the access control system and logs entries	-
Access at the hyperscaler	none; no own staff on site	complete	-
Redundancy model (PS-02)	defines the locations, plans the redundancy and tests it annually	provide the locations	ensures under the complementary customer criteria that the redundancy model and the evidence match its own availability requirements
Office with test and development systems (PS-08)	complete	-	-

Commissioning, storage, transport and decommissioning of your own servers in the cage are covered by the AM domain (AM-06, AM-07, AM-10, AM-11). The complementary subservice organisation controls (CSOC; PS-01.05B speaks of “the complementary subservice organisation controls (CSOC) expected at the service organisations”) are controls that the provider assumes at the subservice organisation when designing its control system. With the carve-out method the auditor does not audit them itself, only whether the assumptions in the system description are fairly presented. Under 3.4.6 the provider remains accountable and monitors the subservice organisations under SSO, in particular SSO-05.

Responsibility matrix: which criterion lies with whom

The table above shows the boundary roughly. For the system description and the monitoring you need the mapping per criterion. This is how we set it up for the example; “Provider” means the control is part of your own control system and is audited even with the carve-out method, “CSOC” means you assume it at the operator and monitor it.

Criterion	Colocation data centre	Hyperscaler (backups)	Office
PS-01 Security requirements	Provider: define requirements, describe and verify CSOC; CSOC: implementation in the building	Provider: describe and verify CSOC; CSOC: implementation	-
PS-02 Redundancy model	Provider: two locations at a distance, annual test	Provider: choice of region and zones for the backups	-
PS-03 Perimeter protection	CSOC	CSOC	-
PS-04 Access control	Provider: granting and revoking authorisations for its own staff and service providers, reconciliation of the lists; CSOC: access system, multi-factor authentication, logging, visitors	CSOC	-
PS-05 Protection against fire, water, lightning	CSOC	CSOC	-
PS-06 Power and utilities	CSOC; Provider: maintenance agreements for its own equipment in the cage, where PS-06.04AC is included	CSOC	-
PS-07 Surveillance of parameters	CSOC; Provider: receipt of alarms, where contractually provided for	CSOC	-
PS-08 Workplaces	-	-	Provider

The matrix shows three things. First, PS-01 stays with the provider even with the carve-out method: PS-01.05B requires the document to describe the expected CSOC and the measures for monitoring them, PS-01.06B the verification of their implementation. Second, the redundancy model is an architecture decision of the provider. According to the supplementary information on PS-02, an architecture that provides the service simultaneously from more than two locations can represent an alternative fulfilment; whether two zones of a hyperscaler region meet the requirement for locations at an adequate distance is something you should assess and justify on the basis of the platform’s information. The definitions in section 1.2 help as a yardstick (a zone comprises at least two locations in close proximity, each location is exclusive to a single zone), as does the supplementary information on PS-02: the distance depends on the assessment of elementary risks at the site, and very extensive events such as floods or earthquakes are not considered. Third, granting access authorisations for your own staff remains your task, even though the operator runs the system.

The office is a special case: if customer data is processed or stored there, as with the copied call-out data in the example, PS-01 to PS-07 apply to the server room; according to the supplementary information on PS-01, the catalogue provides PS-08 for premises in which no customer data is processed or stored. We recommend keeping real customer data away from the test systems; DEV-07.03B in any case requires approval and anonymisation for customer data used in tests (see DEV).

Example control description for PS-01

Our example control for the provider above (own wording, not catalogue text):

Field	Example
Control ID	K-PS-01-01 Verification of the data centre operators’ CSOC
Mapped to	PS-01.05B, PS-01.06B; monitoring under SSO-05
Objective	For every location where customer data is processed or backed up, it is described which physical controls the provider assumes at the operator, and it is evidenced at least annually that the operator has implemented them.
Owner	Head of operations (execution); checked by the information security officer; purchasing (contractual rights to reports and site visits)
Trigger and frequency	annually per operator; additionally when a contract is concluded, when a location changes and when the operator reports a security incident
Execution	The CSOC list per location is derived from PS-03 to PS-07, for example an access system with logging and multi-factor authentication for areas with systems for customer data, a fire alarm system with reporting to the fire department, N+1 for power and cooling, annual tests of UPS and emergency power supply. The head of operations requests the current audit reports or certificates, maps the controls audited there to the CSOC list and documents which CSOC are evidenced, which are not and which period is covered. For CSOC that are not evidenced, the head of operations obtains supplementary evidence, for example a record of the emergency power supply tests, or plans a site visit.
Check	The information security officer checks the evaluation for completeness and ensures that deviations in the operators’ reports have been assessed.
Escalation	If a CSOC is not evidenced or the operator reports a deviation, this goes into the risk register as a risk; the risk owner decides on measures, for example a follow-up request or a change of location.
Evidence	CSOC list per location, operators’ reports and certificates with date, evaluation per operator, risk entries, contract clauses on reports and site visits

How to evaluate the reports of subservice organisations as a whole and record them in the inventory is shown on the page Subservice inventory. Important for type 2: the evaluation must have taken place within the audit period, and the operator’s report should cover a period that matches yours.

Diagram “Who covers physical security?” for C5 PS with colocation and hyperscaler. Highlighted at the top, the example control: for every location operated by a third party, describe the expected CSOC and verify their implementation at least annually, also with the carve-out method, monitoring under SSO-05 (PS-01.05B, PS-01.06B). Below, three columns. Colocation data centre: operator (CSOC) for perimeter, fire, water, lightning, power and cooling, surveillance of the parameters and access system (PS-03 to PS-07); provider grants and revokes access authorisations and runs two locations at a distance with an annual test (PS-04, PS-02). Hyperscaler: platform (CSOC) for all building controls and access (PS-03 to PS-07); provider chooses region and zones for the backups (PS-02). Office: no operator, the provider is fully responsible for the workplace security requirements (PS-08); if customer data is processed there, PS-08 alone no longer applies. — Tap the graphic to open it at full size.Division of physical security with data centres operated by third parties. Source: BSI, Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1, sections 3.4.6 and 5.5; own illustration.

What evidence the auditor wants to see

With the carve-out method the auditor does not look at the building controls itself. The auditor does, however, want to see the controls that remain with the provider. Examples from our scenario:

Evidence	Criterion	Source	Owner	Timing
Security requirements for buildings and premises with security areas, derived from policy, protection needs and risk assessment	PS-01.01B, PS-01.02B	ISMS documentation	information security officer	version valid in the period
CSOC list and description of the monitoring per location	PS-01.05B	ISMS documentation, system description	head of operations	version valid in the period
Evaluation of the operators’ reports	PS-01.06B	evaluation record	head of operations	annual evaluation in the period
Redundancy concept and record of the switchover test	PS-02.01B to 03B	operations documentation, test record	head of operations	at least one test per year
Operators’ access lists reconciled with the staff and service provider list, revocation requests	PS-04.01B	operators’ lists, tickets	head of operations	every reconciliation in the period
Security requirements for the office based on a risk assessment	PS-08.01B	ISMS documentation	information security officer	version valid in the period

An evidence register maps each subcriterion to its evidence; how to keep one is shown on the page Evidence and documentation.

Possible gaps: cause, effect, remedy

The following gaps follow from the wording of the criteria and the scenario above. If a single subcriterion is not met, the criterion counts as not met, and the auditor reports the deviation (sections 3.4.12 and 3.4.13).

Possible gap	Cause	Effect	Remedy
CSOC not described	The provider relies on the operator’s certificate.	PS-01.05B requires the expected CSOC and the measures for monitoring them to be described; without them, the basis for the presentation in the system description is missing as well.	Derive the CSOC list per location from PS-03 to PS-07.
Operators’ reports not evaluated	Reports never requested.	PS-01.06B requires verification of the implementation of the CSOC under SSO-05.	Contractual right to reports, annual evaluation as in K-PS-01-01.
Outdated access authorisations	The operators’ lists are not reconciled.	PS-04.01B requires a specified procedure for granting and modifying authorisations and their revocation after two months without use, with exceptions only through the process under SP-03.	Quarterly reconciliation with the staff and service provider list, departures as the trigger for revocation requests.
Redundancy not tested	Test only at setup.	PS-02.03B requires the effectiveness of the redundancy to be checked at least annually by tests and exercises.	Combine the annual switchover test with the business continuity test under BCM-04 (see BCM).
Customer data in the office server room	Copies of real data for troubleshooting.	The room then falls under PS-01 to PS-07, which an office does not meet.	Only anonymised test data, troubleshooting in production with logged access.

All criteria of the PS domain

Titles as in the English version 1.0.1, number of subcriteria counted per section 5 (B = basic, AS = sharpening, AC = complementing). The column “What it covers” is our own short description, not catalogue text; the wording of the criteria in the catalogue is binding.

ID	Title (catalogue)	B/AS/AC	What it covers
PS-01	Physical Security and Environmental Control Requirements	6/0/5	Security areas, requirements for data centres derived from risks and, for data centres operated by third parties, the expected CSOC and their verification.
PS-02	Redundancy Model	3/2/0	Operation from at least two locations at an adequate distance, designed for the availability commitments, tested annually.
PS-03	Perimeter Protection	6/0/1	Structural shell and security measures against break-ins, with a minimum resistance time.
PS-04	Physical Site Access Control	3/0/0	Electronic access control with a granting procedure, revocation of unused authorisations, multi-factor authentication for system rooms, logging and rules for visitors.
PS-05	Protection against Threats from Outside and from the Environment	4/0/0	Structural, technical and organisational measures against fire, smoke, lightning and water.
PS-06	Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities	3/0/4	Redundant power and cooling supply, tested UPSes and emergency power supplies, maintenance and protection of the lines.
PS-07	Surveillance of Operational and Environmental Parameters	2/0/0	Monitoring of utilities and environment with automatic alerting.
PS-08	Workplace Security Requirements	1/0/0	Security requirements for offices based on a risk assessment.

The additional criteria are aimed mainly at data centre operators, for example PS-01.02AC (self-sufficient operation of a location for at least 72 hours in the event of a failure of the external power supply), PS-02.01AS (more than two locations, so that a third remains if two locations fail) and PS-03.01AC (permanently present security personnel, video surveillance and anti-burglary systems). If a customer requires them, with data centres operated by third parties they mainly affect your CSOC.

Relationship to ISO/IEC 27001:2022 Annex A

The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3). The short labels are ours, not titles from the standard. What you can reuse from a certified ISMS as a whole is shown on the page C5 and ISO 27001.

C5:2026	ISO/IEC 27001:2022 Annex A	Topic (short label)	What C5 additionally requires in concrete terms (our assessment)
PS-01, PS-03	A.7.1	Security areas and perimeter	Description and verification of the CSOC, minimum resistance time
PS-02	A.8.14	Redundancy	at least two locations at a distance, annual test
PS-04	A.7.2, A.7.6	Access	revocation after two months without use, multi-factor authentication for system rooms
PS-05	A.7.5	Environmental threats	fire resistance of 90 minutes or equivalent measures, fire alarm reporting to the fire department
PS-06	A.7.11, A.7.12, A.7.13	Utilities, cabling, maintenance	N+1, annual tests, check of the lines at least every two years
PS-07	A.7.4, A.7.11	Monitoring	automatic alerting when the control range is exceeded
PS-08	A.7.3, A.7.7	Offices and workplaces	requirements explicitly based on a risk assessment

Frequently asked questions

Do I have to implement PS if my service runs at a hyperscaler?+

The platform implements the building controls. Where a data centre is operated by third parties, the catalogue generally assumes a subservice organisation. If you apply the carve-out method, its controls are not part of your audit. You do, however, describe the expected complementary subservice organisation controls (CSOC) and verify their implementation (PS-01.05B, PS-01.06B), and the redundancy model under PS-02 remains your decision.

Is a colocation data centre a subservice organisation?+

In principle, yes. The supplementary information on PS-01 names server housing, colocation and IaaS as examples of premises operated by third parties, and section 3.4.6 generally assumes a subservice organisation relationship for data centres operated by third parties, in particular for PS.

Is the data centre’s ISO 27001 certificate sufficient as evidence?+

The catalogue requires verification of the implementation of the CSOC under SSO-05. Whether a certificate or report is sufficient for this depends on which controls and which period it covers. Map the evidenced controls to your CSOC list and obtain supplementary evidence for the rest.

Do I need two data centres?+

PS-02.01B requires the service to be provided from at least two locations at an adequate distance for operational redundancy. According to the supplementary information, an architecture that provides the service simultaneously from more than two locations can be an alternative fulfilment. You test the effectiveness of the redundancy at least annually.

Does PS also apply to my office?+

For offices and other premises without customer data, PS-08 applies, with security requirements based on a risk assessment, explicitly proportionate for rented offices. If customer data is processed or stored in the office, the requirements of PS-01 to PS-07 apply to those premises.

Sources

BSI: C5:2026 web page with downloads (German) (retrieved 2026-11-06)
BSI: C5:2026 web page with downloads (retrieved 2026-11-06)
BSI: Kriterienkatalog Cloud Computing C5:2026, version 1.1.0 (PDF, German), sections 1.2, 3.3, 3.4.6, 3.4.12, 3.4.13 and 5.5 (PS-01 to PS-08), licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
BSI: Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (PDF), sections 1.2, 3.3, 3.4.6, 3.4.12, 3.4.13 and 5.5, licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
BSI: C5 FAQ (German), question “Kann nur ein Cloud-Dienst ein C5-Testat erhalten?” (can only a cloud service receive a C5 attestation?) (retrieved 2026-11-01)
BSI: C5:2026 overview page with downloads (German) (retrieved 2026-11-01)

This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).

C5 domain PS: sharing physical security with data centre operators