SIM · Security Incident Management
SIM-04 Documentation and Reporting of Security Incidents
Changed since C5:2020 · formerly SIM-03
Basic criterion
Moved requirement for information on security incidents or confirmed security breaches to be available to cloud service customers from the additional criterion to the basic criterion.
Additional criterion
Moved requirement for information on security incidents or confirmed security breaches to be available to cloud service customers from the additional criterion to the basic criterion.
Wording in C5:2020
Basic criterion
After a security incident has been processed, the solution is documented in accordance with the contractual agreements and the report is sent to the affected customers for final acknowledgement or, if applicable, as confirmation.
Additional criterion
The customer can either actively approve solutions or the solution is automatically approved after a certain period.
Information on security incidents or confirmed security breaches is made available to all affected customers.
The contract between the Cloud Service Provider and the cloud customer regulates which data is made available to the cloud customer for his own analysis in the event of security incidents.
Basic criterion
After a security incident has been processed, the solution is documented in accordance with the contractual agreements and the documentation is sent to the affected customers for final acknowledgement or, if applicable, as confirmation.
Information on security incidents or confirmed security breaches is made available to all affected customers.
Supplementary information
Security breaches in the sense of this criterion are security incidents caused by unauthorised access and compromise of cloud service customer data or service delivery as a result of violations of policies and procedures or applicable legal and regulatory requirements (cf. HR-04.02B)
Additional criterion
SIM-04.01AC
Additional, complementingThe customer can either actively approve solutions or the solution is automatically approved after a certain period.
SIM-04.02AC
Additional, complementingThe contract between the cloud service provider and the cloud service customer regulates which data is made available to the cloud service customer for his own analysis in the event of security incidents.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and their resolution and that these notifications are timely forwarded to the entity responsible for handling them so that an appropriate response can be made.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources