Domains

COM

Compliance

4 criteria, 7 basic and 8 additional sub-criteria

• COM-01Identification of Applicable Legal, Regulatory, Self-imposed or Contractual Requirements2 sub-criteria: 1 basic, 1 additional
• COM-02Policy for Planning and Conducting Audits4 sub-criteria: 2 basic, 2 additional, with customer criteria
• COM-03Internal Audits of the Information Security Management System6 sub-criteria: 3 basic, 3 additional
• COM-04Information on Information Security Performance and Management Assessment of the ISMS3 sub-criteria: 1 basic, 2 additional

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources