# COM-01 Identification of Applicable Legal, Regulatory, Self-imposed or Contractual Requirements

- Domain: COM – Compliance
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/com-01/

## Basic criterion

### COM-01.01B

The legal, regulatory, self-imposed and contractual requirements relevant to the information security of the cloud service as well as the cloud service provider's procedures for complying with these requirements are explicitly defined and documented.

**Supplementary information:**

The cloud service provider's documentation may refer to the following requirements, among others:

1. Requirements for the protection of personal data (e.g. EU General Data Protection Regulation);
2. Requirements regarding the information security posture of the cloud service provider (e.g. NIS 2 Directive, BSIG as applicable to KRITIS);
3. Compliance requirements based on contractual obligations with cloud service customers (e.g. ISO/IEC 27001, SOC 2, PCI-DSS); and
4. Requirements regarding exchange and use of data (e.g. EU Data Act).

The documentation of the identified requirements and the procedures for complying with these requirements may be spread across several documents and does not necessarily have to be recorded in a single register or directory.

## Additional criterion

### COM-01.01AC (additional, complementing)

The cloud service provider provides an overview of the procedures described in the basic criterion upon request by the cloud service customer.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

No change.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.