OIS · Organisation of Information Security
OIS-01 Information Security Management System (ISMS)
Changed since C5:2020
Basic criterion
Extended list of aspects included in the documentation by the context of the cloud service provider, a description how ISMSM activiriwa cover the cloud service and a description of how the security of the cloud service is maintained and advanced.
Linguistic adjustment to existing terms.
Added requirement to document the scope and boundaries of the cloud service.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Further specified the scope of the certification.
Added requirement regarding the accreditation of the certification body issuing a ISO/IEC 27001 certification.
Wording in C5:2020
Basic criterion
The Cloud Service Provider operates an information security management system (ISMS) in accordance with ISO/IEC 27001. The scope of the ISMS covers the Cloud Service Provider's organisational units, locations and procedures for providing the cloud service.
The measures for setting up, implementing, maintaining and continuously improving the ISMS are documented.
The documentation includes:
- Scope of the ISMS (Section 4.3 of ISO/IEC 27001);
- Declaration of applicability (Section 6.1.3), and
- Results of the last management review (Section 9.3).
Additional criterion
The Information Security Management System (ISMS) has a valid certification according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz.
Basic criterion
The cloud service provider maintains an ISO/IEC 27001-compliant information security management system (ISMS). The scope of the ISMS covers the cloud service provider's organisational units, locations, zones, regions and procedures relevant to the development and operation of the cloud service.
Supplementary information
The basic criterion can also be fulfilled without valid certification of the ISMS according to ISO/IEC 27001 or ISO 27001 based on BSI IT-Grundschutz, if the submitted documentation meets the requirements of ISO/IEC 27001. The auditor has to evaluate whether the documentation meets the referenced requirements of the ISO standard. This does not require a full certification audit of the management system in accordance with ISO 17021, but a focused inspection of the related documentation.
Cross-sectional functions do not need to be integrated into a single ISMS. Instead, multiple ISMS can be established to cover both, cloud service-specific internal control systems and organisation-wide/central functions effectively.
The scope of the ISMS may go beyond the scope of the cloud service provider's system of internal control for the cloud service in scope of an assurance engagement with this criteria catalogue. If the scope of the ISMS is broader than the scope of the assurance engagement, evidence to be obtained about the design and operation of the ISMS can be limited to records that are applicable to the cloud service in scope of the assurance engagement.
The measures for setting up, implementing, maintaining and continuously improving the ISMS are documented. The documentation includes:
- Context of the cloud service provider;
- Scope of the ISMS (section 4.3 of ISO/IEC 27001);
- Statement of applicability (section 6.1.3 of ISO/IEC 27001);
- Overview of how activities in the ISMS cover the cloud service;
- Description of how the cloud service provider maintains and improves the cloud service's security; and
- Results of the last management review (section 9.3 of ISO/IEC 27001).
Additionally, the cloud service provider documents the scope and boundaries of the cloud service under its operational control, including any exclusions or shared-responsibility areas.
Additional criterion
OIS-01.01AS
Additional, sharpens01BThe Information Security Management System (ISMS) has a valid certification according to ISO/IEC 27001 or ISO 27001 based on BSI IT-Grundschutz. The scope of the certification covers the cloud service provider's organisational units, locations, zones, regions, and procedures relevant to the development and operation of the cloud service.
OIS-01.01AC
Additional, complementingExisting valid certifications according to ISO/IEC 27001 are issued and recognised by an accredited certification body.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources