Domains

SP

Security Policies and Procedures

3 criteria, 11 basic and 3 additional sub-criteria

• SP-01Documentation, Communication and Provision of Policies and Procedures4 sub-criteria
• SP-02Review and Approval of Policies and Procedures2 sub-criteria
• SP-03Exceptions from Existing Policies and Procedures8 sub-criteria: 5 basic, 3 additional, with customer criteria

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources