# OIS-02 Information Security Policy

- Domain: OIS – Organisation of Information Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/ois-02/

## Basic criterion

### OIS-02.01B

Top management of the cloud service provider has adopted an information security policy.

**Supplementary information (on 01B, 02B):**

The top management is a natural person or group of persons who make the final decision for the organisation and is responsible for that decision.

### OIS-02.02B

Top management of the cloud service provider has communicated the information security policy to internal and external personnel as well as cloud service customers.

### OIS-02.03B

The information security policy describes:

1. The importance of information security, based on the requirements of cloud service customers in relation to information security;
2. The security objectives and the desired security level, based on the business goals and activities as well as compliance obligations of the cloud service provider;
3. The cloud service provider's commitment to implement the necessary security measures for fulfilling the established security objectives;
4. The most important aspects of the security strategy to achieve the security objectives set; and
5. The organisational structure for information security in the scope of the ISMS.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Extended list of aspects to be described by the information security policy by the commitment of the cloud service provider to implement the security measures required to achieve the established security objectives.

Security objectives and the desired security level are now additionally based on the compliance obligations of the cloud service provider as well.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.