# OIS-06 Contact with Relevant Government Agencies and Interest Groups

- Domain: OIS – Organisation of Information Security
- Since C5:2020: changed (formerly OIS-05)
- Web page: https://c5.patrickscheid.de/en/ois-06/

## Basic criterion

### OIS-06.01B

If the cloud service is used by public sector organisations in Germany, the cloud service provider establishes and maintains contacts with the National IT Situation Centre and the CERT Association of the BSI as appropriate.

**Supplementary information:**

Public sector organisations in Germany are e.g. ministries and authorities. If the cloud service provider does not have customers in the public sector, this criterion is not applicable.

As appropriate means that contacts are established when there is an actual need to do so. For instance, establishing contact with CERT typically involves the reporting of security incidents to CERT and following CERT's communication channels to stay informed about current threats, vulnerabilities and security guidance. Maintaining contact in the sense of OIS-06.01B does in this instance not require the cloud service provider to proactively communicate with CERT unprompted.

For KRITIS (critical infrastructure), as defined in section 2(10) of the BSI Act (BSIG), similar requirements to maintain contact with government agencies and stakeholders may apply under German national law.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Removed former basic criterion. Instead, the former additional criterion was turned into a basic criterion to focus OIS-06 on cloud services used by public sector organisations.

**Additional criterion:**

Additional criterion turned into basic criterion.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.