# Changes since C5:2020 - Web page: https://c5.patrickscheid.de/en/changes/ Status of every criterion according to BSI's changelog. The change notes themselves are in each criterion's Markdown version. ## OIS – Organisation of Information Security - [OIS-01 Information Security Management System (ISMS)](https://c5.patrickscheid.de/en/ois-01/index.html.md): changed - [OIS-02 Information Security Policy](https://c5.patrickscheid.de/en/ois-02/index.html.md): changed - [OIS-03 Interfaces and Dependencies](https://c5.patrickscheid.de/en/ois-03/index.html.md): changed - [OIS-04 Segregation of Duties](https://c5.patrickscheid.de/en/ois-04/index.html.md): changed - [OIS-05 Threat Intelligence](https://c5.patrickscheid.de/en/ois-05/index.html.md): new in C5:2026 - [OIS-06 Contact with Relevant Government Agencies and Interest Groups](https://c5.patrickscheid.de/en/ois-06/index.html.md): changed (formerly OIS-05) - [OIS-07 Risk Management Policy](https://c5.patrickscheid.de/en/ois-07/index.html.md): changed (formerly OIS-06) - [OIS-08 Application of the Risk Management Policy - Risk Assessment](https://c5.patrickscheid.de/en/ois-08/index.html.md): changed (formerly OIS-07) - [OIS-09 Application of the Risk Management Policy - Risk Treatment](https://c5.patrickscheid.de/en/ois-09/index.html.md): new in C5:2026 - [OIS-10 Information Security in Project Management](https://c5.patrickscheid.de/en/ois-10/index.html.md): new in C5:2026 ## SP – Security Policies and Procedures - [SP-01 Documentation, Communication and Provision of Policies and Procedures](https://c5.patrickscheid.de/en/sp-01/index.html.md): changed - [SP-02 Review and Approval of Policies and Procedures](https://c5.patrickscheid.de/en/sp-02/index.html.md): changed - [SP-03 Exceptions from Existing Policies and Procedures](https://c5.patrickscheid.de/en/sp-03/index.html.md): changed ## HR – Personnel - [HR-01 Verification of Qualification and Trustworthiness](https://c5.patrickscheid.de/en/hr-01/index.html.md): changed - [HR-02 Employment Terms and Conditions](https://c5.patrickscheid.de/en/hr-02/index.html.md): changed - [HR-03 Security Training and Awareness Programme](https://c5.patrickscheid.de/en/hr-03/index.html.md): changed - [HR-04 Disciplinary Measures](https://c5.patrickscheid.de/en/hr-04/index.html.md): changed - [HR-05 Responsibilities in the Event of Termination or Change of Employment](https://c5.patrickscheid.de/en/hr-05/index.html.md): changed - [HR-06 Non-disclosure Agreements](https://c5.patrickscheid.de/en/hr-06/index.html.md): changed - [HR-07 Remote Working - Policy](https://c5.patrickscheid.de/en/hr-07/index.html.md): new in C5:2026 - [HR-08 Remote Working - Implementation](https://c5.patrickscheid.de/en/hr-08/index.html.md): new in C5:2026 ## AM – Asset Management - [AM-01 Asset Management Framework](https://c5.patrickscheid.de/en/am-01/index.html.md): new in C5:2026 - [AM-02 Asset Inventory](https://c5.patrickscheid.de/en/am-02/index.html.md): changed (formerly AM-01) - [AM-03 Hardware Asset Inventory](https://c5.patrickscheid.de/en/am-03/index.html.md): new in C5:2026 - [AM-04 Software Asset Inventory](https://c5.patrickscheid.de/en/am-04/index.html.md): new in C5:2026 - [AM-05 Policy for the Proper and Secure Use of Assets](https://c5.patrickscheid.de/en/am-05/index.html.md): changed (formerly AM-02) - [AM-06 Commissioning of Hardware](https://c5.patrickscheid.de/en/am-06/index.html.md): changed (formerly AM-03) - [AM-07 Decommissioning of Hardware](https://c5.patrickscheid.de/en/am-07/index.html.md): changed (formerly AM-04) - [AM-08 Commitment to Proper Use, Safe and Secure Handling and Return of Assets](https://c5.patrickscheid.de/en/am-08/index.html.md): changed (formerly AM-05) - [AM-09 Asset Classification and Labelling](https://c5.patrickscheid.de/en/am-09/index.html.md): changed (formerly AM-06) - [AM-10 Protection of Hardware on Hold](https://c5.patrickscheid.de/en/am-10/index.html.md): new in C5:2026 - [AM-11 Transfer of Hardware](https://c5.patrickscheid.de/en/am-11/index.html.md): new in C5:2026 - [AM-12 Removable Media and Endpoint Devices](https://c5.patrickscheid.de/en/am-12/index.html.md): new in C5:2026 ## PS – Physical Security - [PS-01 Physical Security and Environmental Control Requirements](https://c5.patrickscheid.de/en/ps-01/index.html.md): changed - [PS-02 Redundancy Model](https://c5.patrickscheid.de/en/ps-02/index.html.md): changed - [PS-03 Perimeter Protection](https://c5.patrickscheid.de/en/ps-03/index.html.md): changed - [PS-04 Physical Site Access Control](https://c5.patrickscheid.de/en/ps-04/index.html.md): changed - [PS-05 Protection against Threats from Outside and from the Environment](https://c5.patrickscheid.de/en/ps-05/index.html.md): changed - [PS-06 Protection against Interruptions caused by Power Failures and similar Risks to Supply Facilities](https://c5.patrickscheid.de/en/ps-06/index.html.md): changed - [PS-07 Surveillance of Operational and Environmental Parameters](https://c5.patrickscheid.de/en/ps-07/index.html.md): unchanged - [PS-08 Workplace Security Requirements](https://c5.patrickscheid.de/en/ps-08/index.html.md): new in C5:2026 ## OPS – Operations - [OPS-01 Capacity Management - Planning](https://c5.patrickscheid.de/en/ops-01/index.html.md): unchanged - [OPS-02 Capacity Management - Monitoring](https://c5.patrickscheid.de/en/ops-02/index.html.md): changed - [OPS-03 Capacity Management - Controlling of Resources](https://c5.patrickscheid.de/en/ops-03/index.html.md): changed - [OPS-04 Protection Against Malware - Policies and Procedures](https://c5.patrickscheid.de/en/ops-04/index.html.md): changed - [OPS-05 Protection Against Malware - Implementation](https://c5.patrickscheid.de/en/ops-05/index.html.md): changed - [OPS-06 Data Backup and Recovery - Policies and Procedures](https://c5.patrickscheid.de/en/ops-06/index.html.md): changed - [OPS-07 Data Backup and Recovery - Monitoring](https://c5.patrickscheid.de/en/ops-07/index.html.md): changed - [OPS-08 Data Backup and Recovery - Regular Testing](https://c5.patrickscheid.de/en/ops-08/index.html.md): changed - [OPS-09 Data Backup and Recovery - Storage](https://c5.patrickscheid.de/en/ops-09/index.html.md): changed - [OPS-10 Logging and Monitoring - Policies and Procedures](https://c5.patrickscheid.de/en/ops-10/index.html.md): changed - [OPS-11 Logging and Monitoring - Policies and Procedures for Handling Cloud Service Derived Data and Account Data](https://c5.patrickscheid.de/en/ops-11/index.html.md): changed - [OPS-12 Logging and Monitoring - Access, Retention and Deletion](https://c5.patrickscheid.de/en/ops-12/index.html.md): changed - [OPS-13 Logging and Monitoring - Security Information and Event Management](https://c5.patrickscheid.de/en/ops-13/index.html.md): changed - [OPS-14 Logging and Monitoring - Retention of the Logging Data](https://c5.patrickscheid.de/en/ops-14/index.html.md): changed - [OPS-15 Logging and Monitoring - Accountability](https://c5.patrickscheid.de/en/ops-15/index.html.md): changed - [OPS-16 Logging and Monitoring - Configuration](https://c5.patrickscheid.de/en/ops-16/index.html.md): changed - [OPS-17 Logging and Monitoring - Availability of the Monitoring Software](https://c5.patrickscheid.de/en/ops-17/index.html.md): changed - [OPS-18 Managing Vulnerabilities - Policies and Procedures](https://c5.patrickscheid.de/en/ops-18/index.html.md): changed - [OPS-19 Managing Incidents and Crashes - Policies and Procedures](https://c5.patrickscheid.de/en/ops-19/index.html.md): new in C5:2026 - [OPS-20 Managing Incidents - Implementation](https://c5.patrickscheid.de/en/ops-20/index.html.md): new in C5:2026 - [OPS-21 Managing Crashes - Implementation](https://c5.patrickscheid.de/en/ops-21/index.html.md): new in C5:2026 - [OPS-22 Managing Vulnerabilities, Incidents and Crashes - Penetration Tests](https://c5.patrickscheid.de/en/ops-22/index.html.md): changed (formerly OPS-19) - [OPS-23 Managing Vulnerabilities, Incidents and Crashes - Measurements, Analyses and Assessments of Procedures](https://c5.patrickscheid.de/en/ops-23/index.html.md): unchanged (formerly OPS-20) - [OPS-24 Involvement of Cloud Service Customers in the Event of Incidents](https://c5.patrickscheid.de/en/ops-24/index.html.md): changed (formerly OPS-21) - [OPS-25 Managing Vulnerabilities, Incidents and Crashes - Vulnerability Scans](https://c5.patrickscheid.de/en/ops-25/index.html.md): changed (formerly OPS-22) - [OPS-26 Managing Vulnerabilities, Incidents and Crashes - System Hardening](https://c5.patrickscheid.de/en/ops-26/index.html.md): changed (formerly OPS-23) - [OPS-27 Managing Vulnerabilities - Patch Management Policies and Procedures](https://c5.patrickscheid.de/en/ops-27/index.html.md): new in C5:2026 - [OPS-28 Managing Vulnerabilities - Patch Management Implementation](https://c5.patrickscheid.de/en/ops-28/index.html.md): new in C5:2026 - [OPS-29 Managing Vulnerabilities, Incidents and Crashes - Externally Sourced Components](https://c5.patrickscheid.de/en/ops-29/index.html.md): new in C5:2026 - [OPS-30 Separation of Datasets - Policies and Procedures](https://c5.patrickscheid.de/en/ops-30/index.html.md): new in C5:2026 - [OPS-31 Separation of Datasets - Implementation](https://c5.patrickscheid.de/en/ops-31/index.html.md): changed (formerly OPS-24) - [OPS-32 Confidential Computing - Policies and Procedures](https://c5.patrickscheid.de/en/ops-32/index.html.md): new in C5:2026 - [OPS-33 Confidential Computing - Remote Attestation](https://c5.patrickscheid.de/en/ops-33/index.html.md): new in C5:2026 - [OPS-34 Container Management - Policies and Procedures](https://c5.patrickscheid.de/en/ops-34/index.html.md): new in C5:2026 - [OPS-35 Container Management - Implementation](https://c5.patrickscheid.de/en/ops-35/index.html.md): new in C5:2026 ## IAM – Identity and Access Management - [IAM-01 Policy for Identities and Access Rights](https://c5.patrickscheid.de/en/iam-01/index.html.md): changed (formerly IDM-01) - [IAM-02 Granting and Change of Identities and Access Rights](https://c5.patrickscheid.de/en/iam-02/index.html.md): changed (formerly IDM-02) - [IAM-03 Risk-Based Procedure for Locking and Withdrawal of Identities](https://c5.patrickscheid.de/en/iam-03/index.html.md): changed (formerly IDM-03) - [IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes](https://c5.patrickscheid.de/en/iam-04/index.html.md): changed (formerly IDM-04) - [IAM-05 Regular Review of Access Rights](https://c5.patrickscheid.de/en/iam-05/index.html.md): changed (formerly IDM-05) - [IAM-06 Privileged Access Rights](https://c5.patrickscheid.de/en/iam-06/index.html.md): changed (formerly IDM-06) - [IAM-07 Access to Cloud Service Customer Data](https://c5.patrickscheid.de/en/iam-07/index.html.md): changed (formerly IDM-07) - [IAM-08 Authentication Mechanisms](https://c5.patrickscheid.de/en/iam-08/index.html.md): changed (formerly IDM-08) - [IAM-09 Confidentiality of Authentication Information](https://c5.patrickscheid.de/en/iam-09/index.html.md): changed (formerly IDM-09) ## CRY – Cryptography and Key Management - [CRY-01 Policy for the Use of Cryptographic Mechanisms](https://c5.patrickscheid.de/en/cry-01/index.html.md): changed - [CRY-02 Cryptographic Change Management](https://c5.patrickscheid.de/en/cry-02/index.html.md): new in C5:2026 - [CRY-03 Review of Cryptography Practices](https://c5.patrickscheid.de/en/cry-03/index.html.md): new in C5:2026 - [CRY-04 Protection of Data for Transmission (Transport Protection)](https://c5.patrickscheid.de/en/cry-04/index.html.md): changed (formerly CRY-02) - [CRY-05 Encryption of Sensitive Data at Rest](https://c5.patrickscheid.de/en/cry-05/index.html.md): changed (formerly CRY-03) - [CRY-06 Secure Key Generation](https://c5.patrickscheid.de/en/cry-06/index.html.md): changed (formerly CRY-04) - [CRY-07 Rotation of Cryptographic Keys](https://c5.patrickscheid.de/en/cry-07/index.html.md): changed (formerly CRY-04) - [CRY-08 Public-Key Certificate Issuance](https://c5.patrickscheid.de/en/cry-08/index.html.md): changed (formerly CRY-04) - [CRY-09 Secure Key Provisioning](https://c5.patrickscheid.de/en/cry-09/index.html.md): changed (formerly CRY-04) - [CRY-10 Secure Storage of Keys](https://c5.patrickscheid.de/en/cry-10/index.html.md): changed (formerly CRY-04) - [CRY-11 Cryptographic Key Archival](https://c5.patrickscheid.de/en/cry-11/index.html.md): new in C5:2026 - [CRY-12 Cryptographic Key Transition Management](https://c5.patrickscheid.de/en/cry-12/index.html.md): changed (formerly CRY-04) - [CRY-13 Handling of Compromised Keys](https://c5.patrickscheid.de/en/cry-13/index.html.md): changed (formerly CRY-04) - [CRY-14 Secure Deactivation of Cryptographic Keys](https://c5.patrickscheid.de/en/cry-14/index.html.md): changed (formerly CRY-04) - [CRY-15 Requirements for Pre-Shared Keys](https://c5.patrickscheid.de/en/cry-15/index.html.md): changed (formerly CRY-04) - [CRY-16 Operational Continuity for Key Management](https://c5.patrickscheid.de/en/cry-16/index.html.md): new in C5:2026 - [CRY-17 Cryptographic Key Lifecycle Management](https://c5.patrickscheid.de/en/cry-17/index.html.md): changed (formerly CRY-04) - [CRY-18 Usage of External Key Management Systems](https://c5.patrickscheid.de/en/cry-18/index.html.md): new in C5:2026 - [CRY-19 Secure Handling of Customer Managed Keys](https://c5.patrickscheid.de/en/cry-19/index.html.md): new in C5:2026 ## COS – Communication Security - [COS-01 Technical Safeguards](https://c5.patrickscheid.de/en/cos-01/index.html.md): changed - [COS-02 Security Requirements for Connections in the Cloud Service Provider's Network](https://c5.patrickscheid.de/en/cos-02/index.html.md): changed - [COS-03 Monitoring of Connections in the Cloud Service Provider's Network](https://c5.patrickscheid.de/en/cos-03/index.html.md): changed - [COS-04 Cross-Network Access](https://c5.patrickscheid.de/en/cos-04/index.html.md): unchanged - [COS-05 Networks for Administration](https://c5.patrickscheid.de/en/cos-05/index.html.md): changed - [COS-06 Separation of Data Traffic in Jointly Used Network Environments](https://c5.patrickscheid.de/en/cos-06/index.html.md): changed - [COS-07 Documentation of the Network Topology](https://c5.patrickscheid.de/en/cos-07/index.html.md): changed - [COS-08 Policies for Data Transmission](https://c5.patrickscheid.de/en/cos-08/index.html.md): changed ## PI – Portability and Interoperability - [PI-01 Safety of Input and Output Interfaces](https://c5.patrickscheid.de/en/pi-01/index.html.md): changed - [PI-02 Contractual Agreements for the Provision of Data](https://c5.patrickscheid.de/en/pi-02/index.html.md): changed - [PI-03 Secure Deletion of Data](https://c5.patrickscheid.de/en/pi-03/index.html.md): changed ## DEV – Procurement, Development and Modification of Information Systems - [DEV-01 Policies for the Development/Procurement of System Components](https://c5.patrickscheid.de/en/dev-01/index.html.md): changed - [DEV-02 Outsourcing of the Development](https://c5.patrickscheid.de/en/dev-02/index.html.md): changed - [DEV-03 Policies for Changes to System Components](https://c5.patrickscheid.de/en/dev-03/index.html.md): changed - [DEV-04 Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools](https://c5.patrickscheid.de/en/dev-04/index.html.md): changed - [DEV-05 Design Documentation for Security Features](https://c5.patrickscheid.de/en/dev-05/index.html.md): new in C5:2026 - [DEV-06 Risk Assessment, Categorisation and Prioritisation of Changes](https://c5.patrickscheid.de/en/dev-06/index.html.md): changed (formerly DEV-05) - [DEV-07 Testing Changes](https://c5.patrickscheid.de/en/dev-07/index.html.md): changed (formerly DEV-06) - [DEV-08 Logging of Changes](https://c5.patrickscheid.de/en/dev-08/index.html.md): changed (formerly DEV-07) - [DEV-09 Version Control](https://c5.patrickscheid.de/en/dev-09/index.html.md): changed (formerly DEV-08) - [DEV-10 Approvals for Provision in the Production Environment](https://c5.patrickscheid.de/en/dev-10/index.html.md): changed (formerly DEV-09) - [DEV-11 Protection of Development and Test Environments](https://c5.patrickscheid.de/en/dev-11/index.html.md): new in C5:2026 - [DEV-12 Separation of Environments](https://c5.patrickscheid.de/en/dev-12/index.html.md): changed (formerly DEV-10) - [DEV-13 Transparency about Software Components](https://c5.patrickscheid.de/en/dev-13/index.html.md): new in C5:2026 - [DEV-14 Secure Use of Third Party Hardware and Software](https://c5.patrickscheid.de/en/dev-14/index.html.md): new in C5:2026 - [DEV-15 Exceptions to the Change Management Process](https://c5.patrickscheid.de/en/dev-15/index.html.md): new in C5:2026 ## SSO – Control and Monitoring of Service Providers and Suppliers - [SSO-01 Policies and Procedures for Controlling and Monitoring Service Organisations](https://c5.patrickscheid.de/en/sso-01/index.html.md): changed - [SSO-02 Risk Assessment of Service Organisations](https://c5.patrickscheid.de/en/sso-02/index.html.md): changed - [SSO-03 Data Processing of Service Organisations](https://c5.patrickscheid.de/en/sso-03/index.html.md): new in C5:2026 - [SSO-04 Directory of Service Organisations](https://c5.patrickscheid.de/en/sso-04/index.html.md): changed (formerly SSO-03) - [SSO-05 Monitoring of Compliance with Requirements](https://c5.patrickscheid.de/en/sso-05/index.html.md): changed (formerly SSO-04) - [SSO-06 Contract Termination Strategy for Service Organisations](https://c5.patrickscheid.de/en/sso-06/index.html.md): changed (formerly SSO-05) - [SSO-07 Ensuring Transparency within Service Organisations](https://c5.patrickscheid.de/en/sso-07/index.html.md): new in C5:2026 - [SSO-08 Controlling Exchanges with Suppliers of Functional Components](https://c5.patrickscheid.de/en/sso-08/index.html.md): new in C5:2026 ## SIM – Security Incident Management - [SIM-01 Policy for Security Incident Management](https://c5.patrickscheid.de/en/sim-01/index.html.md): changed - [SIM-02 Security Incident Response Plans](https://c5.patrickscheid.de/en/sim-02/index.html.md): new in C5:2026 - [SIM-03 Processing of Security Incidents](https://c5.patrickscheid.de/en/sim-03/index.html.md): changed (formerly SIM-02) - [SIM-04 Documentation and Reporting of Security Incidents](https://c5.patrickscheid.de/en/sim-04/index.html.md): changed (formerly SIM-03) - [SIM-05 Duty of the Personnel to Report Security Incidents to a Central Body](https://c5.patrickscheid.de/en/sim-05/index.html.md): changed (formerly SIM-04) - [SIM-06 Evaluation and Learning Process](https://c5.patrickscheid.de/en/sim-06/index.html.md): changed (formerly SIM-05) ## BCM – Business Continuity Management - [BCM-01 Business Continuity and Emergency Management System](https://c5.patrickscheid.de/en/bcm-01/index.html.md): changed - [BCM-02 Business Impact Analysis](https://c5.patrickscheid.de/en/bcm-02/index.html.md): changed - [BCM-03 Business Continuity Plans](https://c5.patrickscheid.de/en/bcm-03/index.html.md): changed - [BCM-04 Testing Business Continuity](https://c5.patrickscheid.de/en/bcm-04/index.html.md): changed ## COM – Compliance - [COM-01 Identification of Applicable Legal, Regulatory, Self-imposed or Contractual Requirements](https://c5.patrickscheid.de/en/com-01/index.html.md): changed - [COM-02 Policy for Planning and Conducting Audits](https://c5.patrickscheid.de/en/com-02/index.html.md): changed - [COM-03 Internal Audits of the Information Security Management System](https://c5.patrickscheid.de/en/com-03/index.html.md): changed - [COM-04 Information on Information Security Performance and Management Assessment of the ISMS](https://c5.patrickscheid.de/en/com-04/index.html.md): changed ## INQ – Dealing with Investigation Requests from Government Agencies - [INQ-01 Legal Assessment of Investigation Requests](https://c5.patrickscheid.de/en/inq-01/index.html.md): changed (formerly INQ-01, INQ-03) - [INQ-02 Informing Cloud Service Customers about Investigation Requests](https://c5.patrickscheid.de/en/inq-02/index.html.md): changed - [INQ-03 Limiting Access to or Disclosure of Data in Investigation Requests](https://c5.patrickscheid.de/en/inq-03/index.html.md): changed (formerly INQ-04) - [INQ-04 Communication of Technical Procedures for Data Disclosure in Investigation Requests](https://c5.patrickscheid.de/en/inq-04/index.html.md): new in C5:2026 ## PSS – Product Safety and Security - [PSS-01 Guidelines and Recommendations for Cloud Service Customers](https://c5.patrickscheid.de/en/pss-01/index.html.md): changed - [PSS-02 Identification of Vulnerabilities of the Cloud Service](https://c5.patrickscheid.de/en/pss-02/index.html.md): changed - [PSS-03 Informing Customers about Known Vulnerabilities](https://c5.patrickscheid.de/en/pss-03/index.html.md): changed - [PSS-04 Error handling and Logging Mechanisms](https://c5.patrickscheid.de/en/pss-04/index.html.md): changed - [PSS-05 Authentication Mechanisms](https://c5.patrickscheid.de/en/pss-05/index.html.md): changed - [PSS-06 Session Management](https://c5.patrickscheid.de/en/pss-06/index.html.md): changed - [PSS-07 Confidentiality of Authentication Information](https://c5.patrickscheid.de/en/pss-07/index.html.md): changed - [PSS-08 Roles and Rights Framework](https://c5.patrickscheid.de/en/pss-08/index.html.md): changed - [PSS-09 Authorisation Mechanisms](https://c5.patrickscheid.de/en/pss-09/index.html.md): changed - [PSS-10 Software Defined Networking](https://c5.patrickscheid.de/en/pss-10/index.html.md): unchanged - [PSS-11 Images for Virtual Machines and Containers](https://c5.patrickscheid.de/en/pss-11/index.html.md): changed - [PSS-12 Region of Data Processing and Storage](https://c5.patrickscheid.de/en/pss-12/index.html.md): changed --- Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.