COM-03 Internal Audits of the Information Security Management System
Changed since C5:2020
Basic criterion
Included effectiveness of organisational and operational measures to manage the risks posed to the security of network and information systems as one aspect to be checked. Also formatted requirement as a list for better readability.
Added requirement regarding the separation of the lines of authority.
Added non-conformities from the applicable legal, regulatory, self-imposed and contractual requirements as one of the aspects to be covered in the risk assessment.
Additional criterion
Modified requirment for the procedures for the automatic monitoring of certain internal audit-relevant aspects to be based on a risk assessment and technical feasibility.
Further specified the means by which cloud service customers can check compliance in real time to be interfaces provided by the cloud service provider.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
Subject matter experts check the compliance of the information security management system at regular intervals, at least annually, with the relevant and applicable legal, regulatory, self-imposed or contractual requirements (cf. COM-01) as well as compliance with the policies and instructions (cf. SP-01) within their scope of responsibility (cf. OIS-01) through internal audits (cf. § 9.3 of ISO/IEC 27001).
Identified vulnerabilities and deviations are subject to risk assessment in accordance with the risk management procedure (cf. OIS-06) and follow-up measures are defined and tracked (cf. OPS-18).
Additional criterion
Internal audits are supplemented by procedures to automatically monitor applicable requirements of policies and instructions with regard to the following aspects:
- Configuration of system components to provide the cloud service within the Cloud Service Provider's area of responsibility;
- Performance and availability of these system components;
- Response time to malfunctions and security incidents;
- Recovery time (time to completion of error handling);
Identified vulnerabilities and deviations are automatically reported to the appropriate Cloud Service Provider’s subject matter experts for immediate assessment and action.
Cloud customers can view compliance with selected contractual requirements in real time.
Basic criterion
Subject matter experts check the compliance of the information security management system at regular intervals, at least annually, with the relevant and applicable legal, regulatory, self-imposed or contractual requirements (cf. COM-01) through internal audits. This includes checks regarding:
Supplementary information
Subject matter experts operate, e.g., in the cloud service provider's internal revision department or expert third parties commissioned by the cloud service provider, such as auditing companies, and may hold relevant certifications such as 'Certified Internal Auditor (CIA)'.
With regard to ISMS compliance, cf. section 9.2 of ISO/IEC 27001, which outlines the requirements for conducting internal audits of an Information Security Management System (ISMS) and for establishing an internal audit programme. When establishing the internal audit programme(s), the cloud service provider should define the scope and criteria by considering the importance of the processes concerned and the results of previous audits. This approach allows cloud service providers to define the audit scope based on the criticality of complying with relevant legal, regulatory, or contractual requirements (cf. COM-01) and internal policies and procedures (cf. SP-01), without requiring a comprehensive review of all requirements during each audit cycle.
Subject matter experts conducting internal audits are not in the line of authority of the personnel of the area under review. If the size of the cloud service provider does not allow such separation of line of authority, alternative measures to guarantee the impartiality of compliance checks are put in place.
Identified vulnerabilities and deviations as well as non-conformities from the applicable legal, regulatory, self-imposed and contractual requirements relevant to the information security of the cloud service, are subjected to a risk assessment in accordance with the risk management procedure (cf. OIS-07). Follow-up measures are defined and tracked (cf. OPS-18).
Additional criterion
COM-03.01AC
Additional, complementingBased on a risk assessment (cf. OIS-07) and technical feasibility, the cloud service provider decides to which extent internal audits are supplemented by procedures to automatically monitor applicable requirements of policies and procedures with regard to the following aspects:
- Configuration of system components to provide the cloud service within the cloud service provider's area of responsibility;
- Performance and availability of these system components;
- Response time to incidents and security incidents; and
- Recovery time (time to completion of error handling).
COM-03.02AC
Additional, complementingIdentified vulnerabilities and deviations are automatically reported to the appropriate cloud service provider's subject matter experts for immediate assessment and action.
COM-03.03AC
Additional, complementingThe cloud service provider provides interfaces to cloud service customers so that they can check compliance with selected contractual agreements in real time.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources