SIM · Security Incident Management
SIM-06 Evaluation and Learning Process
Changed since C5:2020 · formerly SIM-05
Basic criterion
Added requirement regarding the implementation of a knowledge repository. Further require the identification of security events or incidents to also consider the intelligence from the knowledge repository.
Wording in C5:2020
Basic criterion
Mechanisms are in place to measure and monitor the type and scope of security incidents and to report them to support agencies. The information obtained from the evaluation is used to identify recurrent or significant incidents and to identify the need for further protection.
Basic criterion
Mechanisms are in place to measure and monitor the type and scope of security incidents and to report them to supporting bodies.
Supplementary information
Supporting bodies may be external service providers or government agencies such as the BSI.
The cloud service provider defines, implements and maintains a knowledge repository containing:
- Security incidents;
- Measures taken for the solution of these security incidents; and
- Information about the assets affected by these security incidents.
This information is used to supplement the classification catalogue of incidents (cf. SIM-03).
The information obtained from the security incident monitoring and the intelligence gathered in the knowledge repository is used to identify recurring security events or security incidents, or potential significant security incidents, to determine the need for advanced safeguards, and for implementing them.
The evaluation and learning process includes the results of root-cause analyses conducted in accordance with SIM-03.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they include into their ISMS the findings and measures related to previous security incidents reported by the cloud service provider. The cloud service customers evaluate whether and which supporting measures they might take on their side.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources