SSO · Control and Monitoring of Service Providers and Suppliers
SSO-01 Policies and Procedures for Controlling and Monitoring Service Organisations
Changed since C5:2020
Basic criterion
Specified third parties to which this criterion applies to be service organisations.
Specified last list item to be applicable to subservice organisations used by the service organisations.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Rephrased requirement regarding the content and quality of the reports.
Removed requirement for the subservice organisation and the cloud service provider to agree on appropriate information and audit rights if no reports can be provided.
Wording in C5:2020
Basic criterion
Policies and instructions for controlling and monitoring third parties (e.g. service providers or suppliers) whose services contribute to the provision of the cloud service are documented, communicated and provided in accordance with SP-01 with respect to the following aspects:
- Requirements for the assessment of risks resulting from the procurement of third-party services;
- Requirements for the classification of third parties based on the risk assessment by the Cloud Service Provider and the determination of whether the third party is a subcontractor (cf. Supplementary Information);
- Information security requirements for the processing, storage or transmission of information by third parties based on recognised industry standards;
- Information security awareness and training requirements for staff;
- applicable legal and regulatory requirements;
- Requirements for dealing with vulnerabilities, security incidents and malfunctions;
- Specifications for the contractual agreement of these requirements;
- Specifications for the monitoring of these requirements; and
- Specifications for applying these requirements also to service providers used by the third parties, insofar as the services provided by these service providers also contribute to the provision of the cloud service.
Additional criterion
Subservice organisations of the Cloud Service Provider are contractually obliged to provide regular reports by independent auditors on the suitability of the design and operating effectiveness of their service-related internal control system.
The reports include the complementary subservice organisations that are required, together with the controls of the Cloud Service Provider, to meet the applicable basic criteria of BSI C5 with reasonable assurance.
In case no reports can be provided, the Cloud Service Provider agrees appropriate information and audit rights to assess the suitability and effectiveness of the service-related internal control system, including the complementary controls, by qualified personnel.
Basic criterion
Policies and procedures for controlling and monitoring service organisations whose services contribute to the development or operation of the cloud service are documented, communicated and provided in accordance with SP-01 with respect to the following aspects:
- Requirements for the assessment of risks resulting from the procurement of third-party services;
- Requirements for the classification of service organisations based on the risk assessment by the cloud service provider and the determination of whether the service organisation is a subservice organisation;
- Information security requirements for the processing, storage or transmission of information by service organisations based on the established rules of technology, and under consideration of the criteria in this catalogue;
- Information security awareness and training requirements for personnel;
- Applicable legal and regulatory requirements;
- Requirements for dealing with vulnerabilities, security incidents and incidents;
- Specifications for the contractual agreement of these requirements;
- Specifications for the monitoring of these requirements; and
- Specifications for applying these requirements also to subservice organisations used by the service organisations, insofar as the services provided by these subservice organisations also contribute to the development or operation of the cloud service.
Supplementary information
Also applies to 01AC
The basic criterion applies to all service organisations of the cloud service provider, regardless of applying the 'inclusive' or 'carve-out method'. The additional criterion applies only to those of the service organisations that are considered to be subservice organisations. See section 'Consideration of Subservice Organisations'.
Reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.
Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright.
If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subservice organisations, these regulations remain unaffected by the C5 criteria.
Additional criterion
SSO-01.01AC
Additional, complementingSubservice organisations of the cloud service provider are contractually obliged to provide regular reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control system that allow the cloud service provider to determine whether the subservice organisation designed and operated controls that are commensurate with the expected complementary subservice organisation controls (CSOC).
Supplementary information
Also applies to 01B
The basic criterion applies to all service organisations of the cloud service provider, regardless of applying the 'inclusive' or 'carve-out method'. The additional criterion applies only to those of the service organisations that are considered to be subservice organisations. See section 'Consideration of Subservice Organisations'.
Reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.
Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright.
If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subservice organisations, these regulations remain unaffected by the C5 criteria.
SSO-01.02AC
Additional, complementingIn case no such reports can be provided, the cloud service provider agrees appropriate information and audit rights to assess the design and operations of the service-related system of internal control regarding the expected CSOC.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources