# OIS-01 Information Security Management System (ISMS)

- Domain: OIS – Organisation of Information Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ois-01/

## Basic criterion

### OIS-01.01B

The cloud service provider maintains an ISO/IEC 27001-compliant information security management system (ISMS). The scope of the ISMS covers the cloud service provider's organisational units, locations, zones, regions and procedures relevant to the development and operation of the cloud service.

**Supplementary information:**

The basic criterion can also be fulfilled without valid certification of the ISMS according to ISO/IEC 27001 or ISO 27001 based on BSI IT-Grundschutz, if the submitted documentation meets the requirements of ISO/IEC 27001. The auditor has to evaluate whether the documentation meets the referenced requirements of the ISO standard. This does not require a full certification audit of the management system in accordance with ISO 17021, but a focused inspection of the related documentation.

Cross-sectional functions do not need to be integrated into a single ISMS. Instead, multiple ISMS can be established to cover both, cloud service-specific internal control systems and organisation-wide/central functions effectively.

The scope of the ISMS may go beyond the scope of the cloud service provider's system of internal control for the cloud service in scope of an assurance engagement with this criteria catalogue. If the scope of the ISMS is broader than the scope of the assurance engagement, evidence to be obtained about the design and operation of the ISMS can be limited to records that are applicable to the cloud service in scope of the assurance engagement.

### OIS-01.02B

The measures for setting up, implementing, maintaining and continuously improving the ISMS are documented. The documentation includes:

1. Context of the cloud service provider;
2. Scope of the ISMS (section 4.3 of ISO/IEC 27001);
3. Statement of applicability (section 6.1.3 of ISO/IEC 27001);
4. Overview of how activities in the ISMS cover the cloud service;
5. Description of how the cloud service provider maintains and improves the cloud service's security; and
6. Results of the last management review (section 9.3 of ISO/IEC 27001).

### OIS-01.03B

Additionally, the cloud service provider documents the scope and boundaries of the cloud service under its operational control, including any exclusions or shared-responsibility areas.

## Additional criterion

### OIS-01.01AS (additional, sharpens 01B)

The Information Security Management System (ISMS) has a valid certification according to ISO/IEC 27001 or ISO 27001 based on BSI IT-Grundschutz. The scope of the certification covers the cloud service provider's organisational units, locations, zones, regions, and procedures relevant to the development and operation of the cloud service.

### OIS-01.01AC (additional, complementing)

Existing valid certifications according to ISO/IEC 27001 are issued and recognised by an accredited certification body.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Extended list of aspects included in the documentation by the context of the cloud service provider, a description how ISMSM activiriwa cover the cloud service and a description of how the security of the cloud service is maintained and advanced.

Linguistic adjustment to existing terms.

Added requirement to document the scope and boundaries of the cloud service.

Bullet points are now sorted to ease discussions about specific list items.

**Additional criterion:**

Further specified the scope of the certification.

Added requirement regarding the accreditation of the certification body issuing a ISO/IEC 27001 certification.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.