# SIM-04 Documentation and Reporting of Security Incidents

- Domain: SIM – Security Incident Management
- Since C5:2020: changed (formerly SIM-03)
- Web page: https://c5.patrickscheid.de/en/sim-04/

## Basic criterion

### SIM-04.01B

After a security incident has been processed, the solution is documented in accordance with the contractual agreements and the documentation is sent to the affected customers for final acknowledgement or, if applicable, as confirmation.

### SIM-04.02B

Information on security incidents or confirmed security breaches is made available to all affected customers.

**Supplementary information:**

Security breaches in the sense of this criterion are security incidents caused by unauthorised access and compromise of cloud service customer data or service delivery as a result of violations of policies and procedures or applicable legal and regulatory requirements (cf. HR-04.02B)

## Additional criterion

### SIM-04.01AC (additional, complementing)

The customer can either actively approve solutions or the solution is automatically approved after a certain period.

### SIM-04.02AC (additional, complementing)

The contract between the cloud service provider and the cloud service customer regulates which data is made available to the cloud service customer for his own analysis in the event of security incidents.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that they receive notifications from the cloud service provider about security incidents that affect them and their resolution and that these notifications are timely forwarded to the entity responsible for handling them so that an appropriate response can be made.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Moved requirement for information on security incidents or confirmed security breaches to be available to cloud service customers from the additional criterion to the basic criterion.

**Additional criterion:**

Moved requirement for information on security incidents or confirmed security breaches to be available to cloud service customers from the additional criterion to the basic criterion.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.