OIS · Organisation of Information Security
OIS-02 Information Security Policy
Changed since C5:2020
Basic criterion
Extended list of aspects to be described by the information security policy by the commitment of the cloud service provider to implement the security measures required to achieve the established security objectives.
Security objectives and the desired security level are now additionally based on the compliance obligations of the cloud service provider as well.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
The top management of the Cloud Service Provider has adopted an information security policy and communicated it to internal and external employees as well as cloud customers.
The policy describes:
- the importance of information security, based on the requirements of cloud customers in relation to information security;
- the security objectives and the desired security level, based on the business goals and tasks of the Cloud Service Provider;
- the most important aspects of the security strategy to achieve the security objectives set; and
- the organisational structure for information security in the ISMS application area.
Basic criterion
Top management of the cloud service provider has adopted an information security policy.
Supplementary information
Also applies to 02B
The top management is a natural person or group of persons who make the final decision for the organisation and is responsible for that decision.
Top management of the cloud service provider has communicated the information security policy to internal and external personnel as well as cloud service customers.
Supplementary information
Also applies to 01B
The top management is a natural person or group of persons who make the final decision for the organisation and is responsible for that decision.
The information security policy describes:
- The importance of information security, based on the requirements of cloud service customers in relation to information security;
- The security objectives and the desired security level, based on the business goals and activities as well as compliance obligations of the cloud service provider;
- The cloud service provider's commitment to implement the necessary security measures for fulfilling the established security objectives;
- The most important aspects of the security strategy to achieve the security objectives set; and
- The organisational structure for information security in the scope of the ISMS.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources