# SIM-02 Security Incident Response Plans

- Domain: SIM – Security Incident Management
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/sim-02/

## Basic criterion

### SIM-02.01B

The cloud service provider has documented, approved and communicated one or more security incident response plans. The plans address all stages of incident response, including identification, containment, eradication, recovery, and lessons learned. They are approved by subject matter experts of the cloud service provider and communicated to all relevant stakeholders.

**Supplementary information:**

Relevant stakeholders in the sense of this criterion are those that need to know the incident response plan, for example due to their involvement in its execution or due to contractual or regulatory agreements.

### SIM-02.02B

The plans are evaluated and updated at least annually or as necessary to reflect changes in the organisational structure or environment.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.