SP · Security Policies and Procedures
SP-03 Exceptions from Existing Policies and Procedures
Changed since C5:2020
Basic criterion
Added requirement that cloud service providers need to maintain a list of exceptions.
Added requirements regarding the consideration of aggregated risks.
Modified requirement of exceptions being limited in time to exceptions having a defined validity.
Specified that exceptions may not cause deviations from applicable C5 criteria within the scope of the assurance engagement.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
Exceptions to the policies and instructions for information security as well as respective controls go through the OIS-06 risk management process, including approval of these exceptions and acceptance of the associated risks by the risk owners. The approvals of exceptions are documented, limited in time and are reviewed for appropriateness at least annually by the risk owners.
Supplementary information on all sub-criteria
Exceptions in the sense of the criterion can have organisational or technical causes, such as:
- An organisational unit should deviate from the intended processes and procedures in order to meet the requirements of a cloud service customer; and
- A system component lacks technical properties to configure it according to the applicable requirements.
Basic criterion
All exceptions to policies and procedures for information security are maintained in a list, including also the controls associated with the exceptions.
Supplementary information
During an ISO 27001 certification audit, the controls to this criteria are most likely also tested. If it is a joint audit (C5 and ISO), efficiency of audit-once-certify-many may be gained here. If it is a separate audit, the auditor of the C5 attestation engagement can choose to inspect the ISO report instead of testing the control again, if the provided evidence is conclusive enough.
Exceptions to the policies and procedures for information security as well as respective controls go through risk management procedures in accordance with OIS-07, including approval of these exceptions and acceptance of the associated risks by the risk owners.
The risk management procedures in accordance with OIS-07, also take into account the aggregated risk from a combination of single exceptions.
The approvals of exceptions are documented, with a defined validity and reviewed for appropriateness at least annually by the risk owners or by the top management. This review also takes into account the aggregated risk from a combination of single exceptions.
Exceptions in information security policies and procedures that would result in a deviation (cf. 3.4.12) from any applicable C5 criterion within the scope of an assurance engagement (cf. 3.4.1) are not permitted.
Supplementary information
This criterion addresses policies and procedures and demands that on this level, no codified deviations from applicable C5 criteria are permitted.
Additional criterion
SP-03.01AC
Additional, complementingThe exceptions to policies or procedures are approved by the appropriate level of management.
Supplementary information
Appropriate level of management for approval are in most cases either the level of management that approved the policies or procedures or the level of management to whom this task is delegated.
SP-03.02AC
Additional, complementingThe cloud service provider monitors the list of exceptions to prevent the expiration of approved exceptions and ensure the up-to-dateness of all reviews and approvals.
SP-03.03AC
Additional, complementingAny exceptions for which deviations were identified during monitoring are addressed through timely and appropriate remediation measures.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they obtain information from the cloud service provider about exceptions to information security policies and procedures in order to assess and appropriately manage the associated risks to their own information security.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources