SIM · Security Incident Management
SIM-05 Duty of the Personnel to Report Security Incidents to a Central Body
Changed since C5:2020 · formerly SIM-04
Basic criterion
Added requirment to communicate the information security incident reporting mechanisms.
Wording in C5:2020
Basic criterion
The Cloud Service Provider informs employees and external business partners of their obligations. If necessary, they agree to or are contractually obliged to report all security events that become known to them and are directly related to the cloud service provided by the Cloud Service Provider to a previously designated central office of the Cloud Service Provider promptly.
In addition, the Cloud Service Provider communicates that "false reports" of events that do not subsequently turn out to be incidents do not have any negative consequences.
Basic criterion
The cloud service provider informs personnel and external business partners of their obligations. If necessary, they agree to or are contractually obliged to timely report all security events that become known to them and are directly related to the cloud service provided by the cloud service provider to a previously designated central office of the cloud service provider.
The cloud service provider communicates that 'false reports' of events that do not subsequently turn out to be incidents do not have any negative consequences.
The information security incident reporting mechanisms are communicated to personnel, cloud service customers and service organisations of the cloud service provider.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that identified security events, which the cloud service provider is required to process, are communicated timely to previously designated, responsible personnel.
The identification of such security events is supported by suitable controls (cf. complementary criterion for OPS-10).
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources