SP · Security Policies and Procedures
SP-02 Review and Approval of Policies and Procedures
Changed since C5:2020
Basic criterion
Further specified frequency of reviews by requiring them to be performed in case of significant changes as well.
Added requirement regarding communication about revisions to internal and external personnel.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
Information security policies and instructions are reviewed at least annually for adequacy by the Cloud Service Provider's subject matter experts.
The review shall consider at least the following aspects:
- Organisational and technical changes in the procedures for providing the cloud service; and
- Legal and regulatory changes in the Cloud Service Provider's environment.
Revised policies and instructions are approved before they become effective.
Basic criterion
Information security policies and procedures are reviewed for adequacy by the cloud service provider's subject matter experts at least annually, and in case of significant changes to the cloud service. The review shall consider at least the following aspects:
- Organisational and technical changes in the procedures for providing the cloud service; and
- Legal and regulatory changes in the cloud service provider's environment.
Supplementary information
During an ISO 27001 certification audit, the controls to this criteria are most likely also tested. If it is a joint audit (C5 and ISO), efficiency of audit-once-certify-many may be gained here. If it is a separate audit, the auditor of the C5 attestation engagement can choose to inspect the ISO report instead of testing the control again, if the provided evidence is conclusive enough.
Revised policies and procedures are approved by the appropriate level of management before they become effective and are communicated and made available to internal and external personnel.
Supplementary information
Significant changes include, but are not limited to, any circumstances or events that materially affect the scope, effectiveness, or objectives of the information security policy. Specifically, significant changes are e.g.:
- Major technical or architectural changes to the cloud platform (e.g., adoption of new infrastructure services, cloud migration, introduction of a new service offering);
- Substantial updates to national or international laws, regulations, or sector-specific standards (e.g., NIS2, DORA, GDPR) that impact information security obligations;
- Reorganisation or merger/acquisition of organisational units that affect leadership, decision-making, or key responsibilities related to security;
- Significant changes in contractual requirements, risk assessments, operational processes, or threat landscape (e.g., new threat intelligence indicating emerging risks, supply chain incidents);
- Major security incidents or breaches requiring incident response revision;
- Launch or decommissioning of service components impacting customer data or trust boundaries; and
- Changes in the composition or responsibilities of top management or the information security steering committee.
For an efficient review the cloud service provider can document the nature of each significant change, the rationale for review, and the result of policy adjustments. Automated tracking of policy changes and manual verification of content can also be integrated into the review workflow.
The top level management is an appropriate level of management for approving the information security policy.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources