# COM – Compliance

- Web page: https://c5.patrickscheid.de/en/com/

- [COM-01 Identification of Applicable Legal, Regulatory, Self-imposed or Contractual Requirements](https://c5.patrickscheid.de/en/com-01/index.html.md): 2 sub-criteria (1 basic, 1 additional), changed since C5:2020
- [COM-02 Policy for Planning and Conducting Audits](https://c5.patrickscheid.de/en/com-02/index.html.md): 4 sub-criteria (2 basic, 2 additional), with customer criteria, changed since C5:2020
- [COM-03 Internal Audits of the Information Security Management System](https://c5.patrickscheid.de/en/com-03/index.html.md): 6 sub-criteria (3 basic, 3 additional), changed since C5:2020
- [COM-04 Information on Information Security Performance and Management Assessment of the ISMS](https://c5.patrickscheid.de/en/com-04/index.html.md): 3 sub-criteria (1 basic, 2 additional), changed since C5:2020

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.