OIS · Organisation of Information Security
OIS-07 Risk Management Policy
Changed since C5:2020 · formerly OIS-06
Basic criterion
Added requirement that risk assessment methodology enables reproducability and comparability.
Extended aspects to be addressed by the risk management procedures by a of the risk assessment and status of risk treatment plans to be conducted by the responsible management.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
Policies and instructions for risk management procedures are documented, communicated and provided in accordance with SP-01 for the following aspects:
- Identification of risks associated with the loss of confidentiality, integrity, availability and authenticity of information within the scope of the ISMS and assigning risk owners;
- Analysis of the probability and impact of occurrence and determination of the level of risk;
- Evaluation of the risk analysis based on defined criteria for risk acceptance and prioritisation of handling;
- Handling of risks through measures, including approval of authorisation and acceptance of residual risks by risk owners; and
- Documentation of the activities implemented to enable consistent, valid and comparable results.
Basic criterion
Policies and procedures for risk management procedures are documented, communicated and provided in accordance with SP-01. Risk management procedures are based on a methodology for risk assessments. The methodology allows comparability and reproducibility for the following aspects:
- Identification of cybersecurity risks and other risks associated with the loss of confidentiality, integrity, availability and authenticity of information within the scope of the ISMS and assigning risk owners;
- Analysis of the probability and impact of occurrence and determination of the level of risk;
- Evaluation of the risk assessment based on defined criteria for risk acceptance and prioritisation of risk management;
- Treatment of risks through measures, including approval of authorisation and acceptance of residual risks by risk owners;
- Documentation of the activities implemented to enable consistent, valid and comparable results; and
- Evaluation of the risk assessment and the status of risk treatment plans by the level of management responsible for the security of the cloud service.
Supplementary information
The risk level can be determined by qualitative, semiquantitative and quantitative methods (cf. ISO 31010) based on the likelihood and impact of the risks.
For identifying, evaluating, and prioritising potential threats and vulnerabilities associated with processes, systems, and data flows, threat modelling can provide a structured methodology: The cloud service provider can systematically analyse attack vectors and possible impacts to support auditors and stakeholders in validating the suitability of the design of implemented controls, highlight gaps in existing security measures, and ensure alignment with best practices for proactive risk mitigation.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources