Changes since C5:2020
Based on BSI's changelog. Each criterion shows BSI's description of the changes and its C5:2020 wording.
OIS · Organisation of Information Security
- OIS-01Information Security Management System (ISMS)
- OIS-02Information Security Policy
- OIS-03Interfaces and Dependencies
- OIS-04Segregation of Duties
- OIS-05Threat Intelligence
- OIS-06Contact with Relevant Government Agencies and Interest Groups
- OIS-07Risk Management Policy
- OIS-08Application of the Risk Management Policy - Risk Assessment
- OIS-09Application of the Risk Management Policy - Risk Treatment
- OIS-10Information Security in Project Management
SP · Security Policies and Procedures
HR · Personnel
- HR-01Verification of Qualification and Trustworthiness
- HR-02Employment Terms and Conditions
- HR-03Security Training and Awareness Programme
- HR-04Disciplinary Measures
- HR-05Responsibilities in the Event of Termination or Change of Employment
- HR-06Non-disclosure Agreements
- HR-07Remote Working - Policy
- HR-08Remote Working - Implementation
AM · Asset Management
- AM-01Asset Management Framework
- AM-02Asset Inventory
- AM-03Hardware Asset Inventory
- AM-04Software Asset Inventory
- AM-05Policy for the Proper and Secure Use of Assets
- AM-06Commissioning of Hardware
- AM-07Decommissioning of Hardware
- AM-08Commitment to Proper Use, Safe and Secure Handling and Return of Assets
- AM-09Asset Classification and Labelling
- AM-10Protection of Hardware on Hold
- AM-11Transfer of Hardware
- AM-12Removable Media and Endpoint Devices
PS · Physical Security
- PS-01Physical Security and Environmental Control Requirements
- PS-02Redundancy Model
- PS-03Perimeter Protection
- PS-04Physical Site Access Control
- PS-05Protection against Threats from Outside and from the Environment
- PS-06Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities
- PS-07Surveillance of Operational and Environmental Parameters
- PS-08Workplace Security Requirements
OPS · Operations
- OPS-01Capacity Management - Planning
- OPS-02Capacity Management - Monitoring
- OPS-03Capacity Management - Controlling of Resources
- OPS-04Protection Against Malware - Policies and Procedures
- OPS-05Protection Against Malware - Implementation
- OPS-06Data Backup and Recovery - Policies and Procedures
- OPS-07Data Backup and Recovery - Monitoring
- OPS-08Data Backup and Recovery - Regular Testing
- OPS-09Data Backup and Recovery - Storage
- OPS-10Logging and Monitoring - Policies and Procedures
- OPS-11Logging and Monitoring - Policies and Procedures for Handling Cloud Service Derived Data and Account Data
- OPS-12Logging and Monitoring - Access, Retention and Deletion
- OPS-13Logging and Monitoring - Security Information and Event Management
- OPS-14Logging and Monitoring - Retention of the Logging Data
- OPS-15Logging and Monitoring - Accountability
- OPS-16Logging and Monitoring - Configuration
- OPS-17Logging and Monitoring - Availability of the Monitoring Software
- OPS-18Managing Vulnerabilities - Policies and Procedures
- OPS-19Managing Incidents and Crashes - Policies and Procedures
- OPS-20Managing Incidents - Implementation
- OPS-21Managing Crashes - Implementation
- OPS-22Managing Vulnerabilities, Incidents and Crashes - Penetration Tests
- OPS-23Managing Vulnerabilities, Incidents and Crashes - Measurements, Analyses and Assessments of Procedures
- OPS-24Involvement of Cloud Service Customers in the Event of Incidents
- OPS-25Managing Vulnerabilities, Incidents and Crashes - Vulnerability Scans
- OPS-26Managing Vulnerabilities, Incidents and Crashes - System Hardening
- OPS-27Managing Vulnerabilities - Patch Management Policies and Procedures
- OPS-28Managing Vulnerabilities - Patch Management Implementation
- OPS-29Managing Vulnerabilities, Incidents and Crashes - Externally Sourced Components
- OPS-30Separation of Datasets - Policies and Procedures
- OPS-31Separation of Datasets - Implementation
- OPS-32Confidential Computing - Policies and Procedures
- OPS-33Confidential Computing - Remote Attestation
- OPS-34Container Management - Policies and Procedures
- OPS-35Container Management - Implementation
IAM · Identity and Access Management
- IAM-01Policy for Identities and Access Rights
- IAM-02Granting and Change of Identities and Access Rights
- IAM-03Risk-Based Procedure for Locking and Withdrawal of Identities
- IAM-04Withdrawal or Adjustment of Access Rights as the Task Area Changes
- IAM-05Regular Review of Access Rights
- IAM-06Privileged Access Rights
- IAM-07Access to Cloud Service Customer Data
- IAM-08Authentication Mechanisms
- IAM-09Confidentiality of Authentication Information
CRY · Cryptography and Key Management
- CRY-01Policy for the Use of Cryptographic Mechanisms
- CRY-02Cryptographic Change Management
- CRY-03Review of Cryptography Practices
- CRY-04Protection of Data for Transmission (Transport Protection)
- CRY-05Encryption of Sensitive Data at Rest
- CRY-06Secure Key Generation
- CRY-07Rotation of Cryptographic Keys
- CRY-08Public-Key Certificate Issuance
- CRY-09Secure Key Provisioning
- CRY-10Secure Storage of Keys
- CRY-11Cryptographic Key Archival
- CRY-12Cryptographic Key Transition Management
- CRY-13Handling of Compromised Keys
- CRY-14Secure Deactivation of Cryptographic Keys
- CRY-15Requirements for Pre-Shared Keys
- CRY-16Operational Continuity for Key Management
- CRY-17Cryptographic Key Lifecycle Management
- CRY-18Usage of External Key Management Systems
- CRY-19Secure Handling of Customer Managed Keys
COS · Communication Security
- COS-01Technical Safeguards
- COS-02Security Requirements for Connections in the Cloud Service Provider's Network
- COS-03Monitoring of Connections in the Cloud Service Provider's Network
- COS-04Cross-Network Access
- COS-05Networks for Administration
- COS-06Separation of Data Traffic in Jointly Used Network Environments
- COS-07Documentation of the Network Topology
- COS-08Policies for Data Transmission
PI · Portability and Interoperability
DEV · Procurement, Development and Modification of Information Systems
- DEV-01Policies for the Development/Procurement of System Components
- DEV-02Outsourcing of the Development
- DEV-03Policies for Changes to System Components
- DEV-04Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools
- DEV-05Design Documentation for Security Features
- DEV-06Risk Assessment, Categorisation and Prioritisation of Changes
- DEV-07Testing Changes
- DEV-08Logging of Changes
- DEV-09Version Control
- DEV-10Approvals for Provision in the Production Environment
- DEV-11Protection of Development and Test Environments
- DEV-12Separation of Environments
- DEV-13Transparency about Software Components
- DEV-14Secure Use of Third Party Hardware and Software
- DEV-15Exceptions to the Change Management Process
SSO · Control and Monitoring of Service Providers and Suppliers
- SSO-01Policies and Procedures for Controlling and Monitoring Service Organisations
- SSO-02Risk Assessment of Service Organisations
- SSO-03Data Processing of Service Organisations
- SSO-04Directory of Service Organisations
- SSO-05Monitoring of Compliance with Requirements
- SSO-06Contract Termination Strategy for Service Organisations
- SSO-07Ensuring Transparency within Service Organisations
- SSO-08Controlling Exchanges with Suppliers of Functional Components
SIM · Security Incident Management
BCM · Business Continuity Management
COM · Compliance
INQ · Dealing with Investigation Requests from Government Agencies
PSS · Product Safety and Security
- PSS-01Guidelines and Recommendations for Cloud Service Customers
- PSS-02Identification of Vulnerabilities of the Cloud Service
- PSS-03Informing Customers about Known Vulnerabilities
- PSS-04Error handling and Logging Mechanisms
- PSS-05Authentication Mechanisms
- PSS-06Session Management
- PSS-07Confidentiality of Authentication Information
- PSS-08Roles and Rights Framework
- PSS-09Authorisation Mechanisms
- PSS-10Software Defined Networking
- PSS-11Images for Virtual Machines and Containers
- PSS-12Region of Data Processing and Storage
From C5:2020 to C5:2026
Every C5:2020 ID and the criterion it became part of in C5:2026.
- OIS-01
- OIS-01
- OIS-02
- OIS-02
- OIS-03
- OIS-03
- OIS-04
- OIS-04
- OIS-05
- OIS-06
- OIS-06
- OIS-07
- OIS-07
- OIS-08
- SP-01
- SP-01
- SP-02
- SP-02
- SP-03
- SP-03
- HR-01
- HR-01
- HR-02
- HR-02
- HR-03
- HR-03
- HR-04
- HR-04
- HR-05
- HR-05
- HR-06
- HR-06
- AM-01
- AM-02
- AM-02
- AM-05
- AM-03
- AM-06
- AM-04
- AM-07
- AM-05
- AM-08
- AM-06
- AM-09
- PS-01
- PS-01
- PS-02
- PS-02
- PS-03
- PS-03
- PS-04
- PS-04
- PS-05
- PS-05
- PS-06
- PS-06
- PS-07
- PS-07
- OPS-01
- OPS-01
- OPS-02
- OPS-02
- OPS-03
- OPS-03
- OPS-04
- OPS-04
- OPS-05
- OPS-05
- OPS-06
- OPS-06
- OPS-07
- OPS-07
- OPS-08
- OPS-08
- OPS-09
- OPS-09
- OPS-10
- OPS-10
- OPS-11
- OPS-11
- OPS-12
- OPS-12
- OPS-13
- OPS-13
- OPS-14
- OPS-14
- OPS-15
- OPS-15
- OPS-16
- OPS-16
- OPS-17
- OPS-17
- OPS-18
- OPS-18
- OPS-19
- OPS-22
- OPS-20
- OPS-23
- OPS-21
- OPS-24
- OPS-22
- OPS-25
- OPS-23
- OPS-26
- OPS-24
- OPS-31
- IDM-01
- IAM-01
- IDM-02
- IAM-02
- IDM-03
- IAM-03
- IDM-04
- IAM-04
- IDM-05
- IAM-05
- IDM-06
- IAM-06
- IDM-07
- IAM-07
- IDM-08
- IAM-08
- IDM-09
- IAM-09
- CRY-01
- CRY-01
- CRY-02
- CRY-04
- CRY-03
- CRY-05
- COS-01
- COS-01
- COS-02
- COS-02
- COS-03
- COS-03
- COS-04
- COS-04
- COS-05
- COS-05
- COS-06
- COS-06
- COS-07
- COS-07
- COS-08
- COS-08
- PI-01
- PI-01
- PI-02
- PI-02
- PI-03
- PI-03
- DEV-01
- DEV-01
- DEV-02
- DEV-02
- DEV-03
- DEV-03
- DEV-04
- DEV-04
- DEV-05
- DEV-06
- DEV-06
- DEV-07
- DEV-07
- DEV-08
- DEV-08
- DEV-09
- DEV-09
- DEV-10
- DEV-10
- DEV-12
- SSO-01
- SSO-01
- SSO-02
- SSO-02
- SSO-03
- SSO-04
- SSO-04
- SSO-05
- SSO-05
- SSO-06
- SIM-01
- SIM-01
- SIM-02
- SIM-03
- SIM-03
- SIM-04
- SIM-04
- SIM-05
- SIM-05
- SIM-06
- BCM-01
- BCM-01
- BCM-02
- BCM-02
- BCM-03
- BCM-03
- BCM-04
- BCM-04
- COM-01
- COM-01
- COM-02
- COM-02
- COM-03
- COM-03
- COM-04
- COM-04
- INQ-01
- INQ-01
- INQ-02
- INQ-02
- INQ-03
- INQ-01
- INQ-04
- INQ-03
- PSS-01
- PSS-01
- PSS-02
- PSS-02
- PSS-03
- PSS-03
- PSS-04
- PSS-04
- PSS-05
- PSS-05
- PSS-06
- PSS-06
- PSS-07
- PSS-07
- PSS-08
- PSS-08
- PSS-09
- PSS-09
- PSS-10
- PSS-10
- PSS-11
- PSS-11
- PSS-12
- PSS-12
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources