# SIM-01 Policy for Security Incident Management

- Domain: SIM – Security Incident Management
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/sim-01/

## Basic criterion

### SIM-01.01B

Policies, procedures and technical safeguards are documented, communicated and provided in accordance with SP-01 to ensure a fast, effective and proper response to all known security incidents.

The cloud service provider defines guidelines for the classification, prioritisation, escalation and root cause analysis of security incidents and creates interfaces to the incident management and business continuity management.

### SIM-01.02B

The cloud service provider has set up a 'Computer Security Incident Response Team' (CSIRT), which contributes to the coordinated resolution of occurring security incidents.

### SIM-01.03B

Communication channels with the cloud service customers are identified and defined and customers affected by security incidents are informed in a timely and appropriate manner.

### SIM-01.04B

There are procedures as to how the data of a suspicious system can be collected in a conclusive manner in the event of a security incident.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and that these notifications are forwarded in a timely manner to the responsible departments for handling so that an appropriate response can be triggered.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Replaced the term CERT with the term CSIRT.

Added requirement for the identification and definition of communication channels with cloud service customers.

Moved requirement regarding the collection of data from the additional criterion to the basic criterion.

**Additional criterion:**

Moved requirement regarding the collection of data to the basic criterion of SIM-01.

Removed requirement regarding the existence of analysis plans for typical security incidents. Instead, the new basic criterion SIM-02 requires the existence of security incident response plans.

Removed requirement regarding an evaluation methodology that ensures collected information can be used in legal assessments. Instead, SIM-03 now requires information to be archived in a secure and tamper-proof matter.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.