# SSO-01 Policies and Procedures for Controlling and Monitoring Service Organisations

- Domain: SSO – Control and Monitoring of Service Providers and Suppliers
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/sso-01/

## Basic criterion

### SSO-01.01B

Policies and procedures for controlling and monitoring service organisations whose services contribute to the development or operation of the cloud service are documented, communicated and provided in accordance with SP-01 with respect to the following aspects:

1. Requirements for the assessment of risks resulting from the procurement of third-party services;
2. Requirements for the classification of service organisations based on the risk assessment by the cloud service provider and the determination of whether the service organisation is a subservice organisation;
3. Information security requirements for the processing, storage or transmission of information by service organisations based on the established rules of technology, and under consideration of the criteria in this catalogue;
4. Information security awareness and training requirements for personnel;
5. Applicable legal and regulatory requirements;
6. Requirements for dealing with vulnerabilities, security incidents and incidents;
7. Specifications for the contractual agreement of these requirements;
8. Specifications for the monitoring of these requirements; and
9. Specifications for applying these requirements also to subservice organisations used by the service organisations, insofar as the services provided by these subservice organisations also contribute to the development or operation of the cloud service.

**Supplementary information (on 01B, 01AC):**

The basic criterion applies to all service organisations of the cloud service provider, regardless of applying the 'inclusive' or 'carve-out method'. The additional criterion applies only to those of the service organisations that are considered to be subservice organisations. See section 'Consideration of Subservice Organisations'.

Reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control are, for example, attestation reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5.

Applicable legal and regulatory requirements may exist, for example, in the areas of data protection, intellectual property rights or copyright.

If legal or regulatory requirements provide for a regulation deviating from these criteria for the control of subservice organisations, these regulations remain unaffected by the C5 criteria.

## Additional criterion

### SSO-01.01AC (additional, complementing)

Subservice organisations of the cloud service provider are contractually obliged to provide regular reports by independent auditors on the suitability of the design and operating effectiveness of their service-related system of internal control system that allow the cloud service provider to determine whether the subservice organisation designed and operated controls that are commensurate with the expected complementary subservice organisation controls (CSOC).

### SSO-01.02AC (additional, complementing)

In case no such reports can be provided, the cloud service provider agrees appropriate information and audit rights to assess the design and operations of the service-related system of internal control regarding the expected CSOC.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified third parties to which this criterion applies to be service organisations.

Specified last list item to be applicable to subservice organisations used by the service organisations.

Bullet points are now sorted to ease discussions about specific list items.

**Additional criterion:**

Rephrased requirement regarding the content and quality of the reports.

Removed requirement for the subservice organisation and the cloud service provider to agree on appropriate information and audit rights if no reports can be provided.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.