SIM · Security Incident Management
SIM-01 Policy for Security Incident Management
Changed since C5:2020
Basic criterion
Replaced the term CERT with the term CSIRT.
Added requirement for the identification and definition of communication channels with cloud service customers.
Moved requirement regarding the collection of data from the additional criterion to the basic criterion.
Additional criterion
Moved requirement regarding the collection of data to the basic criterion of SIM-01.
Removed requirement regarding the existence of analysis plans for typical security incidents. Instead, the new basic criterion SIM-02 requires the existence of security incident response plans.
Removed requirement regarding an evaluation methodology that ensures collected information can be used in legal assessments. Instead, SIM-03 now requires information to be archived in a secure and tamper-proof matter.
Wording in C5:2020
Basic criterion
Policies and instructions with technical and organisational safeguards are documented, communicated and provided in accordance with SP-01 to ensure a fast, effective and proper response to all known security incidents.
The Cloud Service Provider defines guidelines for the classification, prioritisation and escalation of security incidents and creates interfaces to the incident management and business continuity management.
In addition, the Cloud Service Provider has set up a "Computer Emergency Response Team" (CERT), which contributes to the coordinated resolution of occurring security incidents.
Customers affected by security incidents are informed in a timely and appropriate manner.
Additional criterion
There are instructions as to how the data of a suspicious system can be collected in a conclusive manner in the event of a security incident. In addition, there are analysis plans for typical security incidents and an evaluation methodology so that the collected information does not lose its evidential value in any subsequent legal assessment.
Basic criterion
Policies, procedures and technical safeguards are documented, communicated and provided in accordance with SP-01 to ensure a fast, effective and proper response to all known security incidents.
The cloud service provider defines guidelines for the classification, prioritisation, escalation and root cause analysis of security incidents and creates interfaces to the incident management and business continuity management.
The cloud service provider has set up a 'Computer Security Incident Response Team' (CSIRT), which contributes to the coordinated resolution of occurring security incidents.
Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.
There are procedures as to how the data of a suspicious system can be collected in a conclusive manner in the event of a security incident.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and that these notifications are forwarded in a timely manner to the responsible departments for handling so that an appropriate response can be triggered.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources