# SIM-05 Duty of the Personnel to Report Security Incidents to a Central Body

- Domain: SIM – Security Incident Management
- Since C5:2020: changed (formerly SIM-04)
- Web page: https://c5.patrickscheid.de/en/sim-05/

## Basic criterion

### SIM-05.01B

The cloud service provider informs personnel and external business partners of their obligations. If necessary, they agree to or are contractually obliged to timely report all security events that become known to them and are directly related to the cloud service provided by the cloud service provider to a previously designated central office of the cloud service provider.

### SIM-05.02B

The cloud service provider communicates that 'false reports' of events that do not subsequently turn out to be incidents do not have any negative consequences.

### SIM-05.03B

The information security incident reporting mechanisms are communicated to personnel, cloud service customers and service organisations of the cloud service provider.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that identified security events, which the cloud service provider is required to process, are communicated timely to previously designated, responsible personnel.

The identification of such security events is supported by suitable controls (cf. complementary criterion for OPS-10).

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirment to communicate the information security incident reporting mechanisms.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.