# SIM-03 Processing of Security Incidents

- Domain: SIM – Security Incident Management
- Since C5:2020: changed (formerly SIM-02)
- Web page: https://c5.patrickscheid.de/en/sim-03/

## Basic criterion

### SIM-03.01B

Subject matter experts of the cloud service provider classify, prioritise and perform root-cause analyses for events that could constitute a security incident.

### SIM-03.02B

The results of these root-cause analyses are documented, shared with relevant stakeholders, and used as part of evaluation and learning processes.

### SIM-03.03B

If the cloud service provider determines that it requires external assistance for processing a security incident, it selects an incident response service based on their competence and trustworthiness or by following the recommendations of a national cybersecurity authority.

### SIM-03.04B

A catalogue providing clear identification of information security incidents affecting cloud service customer data is maintained and used for the classification of information security incidents.

### SIM-03.05B

The cloud service provider also uses the incident classification mechanism for the correlation of information security events, and assesses as well as classifies the correlated information security events according to their criticality.

### SIM-03.06B

All documents and evidence that provide details on security incidents related to the cloud service are archived in a secure and tamper-proof manner, in line with criticality and regulatory requirements.

**Supplementary information:**

Regulatory requirements may necessitate maintaining a chain of custody to ensure that documents can be relied upon in legal proceedings.

### SIM-03.07B

The analysis process provides sufficient traceability to understand root causes and attack progression, appropriate to the risk and impact of the security incident.

## Additional criterion

### SIM-03.01AC (additional, complementing)

The cloud service provider simulates the identification, analysis and defence of security incidents and attacks at least once a year through appropriate tests and exercises (e.g. Red Team training).

### SIM-03.02AC (additional, complementing)

An integrated team of forensic/incident responder personnel, specifically qualified to preserve evidence and manage a chain of custody, is established or contracted for their services.

### SIM-03.03AC (additional, complementing)

The cloud service provider verifies the application of incident management policies and procedures by monitoring the information security incident handling processes. Timely and appropriate remediation measures address any deviations identified during monitoring.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirementr defining how to further process the results of the root cause analyses.

Added requirement regarding the selection of extenal assistance.

Added reqruiements for cataloguing, analysing and classifying security incidents, as well as archiving security incident information.

**Additional criterion:**

Added requirement for the estavlishment of a forensic / incident responder team.

Added requirements for the monitoring of security incident handling.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.