SSO · Control and Monitoring of Service Providers and Suppliers
SSO-02 Risk Assessment of Service Organisations
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Changed the order of the requirements within the criterion.
Extended the aspects to be included in the risk assessment by the assumed CSOCs, deviations from assumed CSOCs, the ability to avoid vendor lock-ins, the use of subcontractors by the subservice organisations and the types of data processed by such subcontractors.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
Service providers and suppliers of the Cloud Service Provider undergo a risk assessment in accordance with the policies and instructions for the control and monitoring of third parties prior to contributing to the delivery of the cloud service. The adequacy of the risk assessment is reviewed regularly, at least annually, by qualified personnel of the Cloud Service Provider during service usage.
The risk assessment includes the identification, analysis, evaluation, handling and documentation of risks with regard to the following aspects:
- Protection needs regarding the confidentiality, integrity, availability and authenticity of information processed, stored or transmitted by the third party;
- Impact of a protection breach on the provision of the cloud service;
- The Cloud Service Provider's dependence on the service provider or supplier for the scope, complexity and uniqueness of the service purchased, including the consideration of possible alternatives.
Basic criterion
Service organisations of the cloud service provider undergo a risk assessment in accordance with the policies and procedures for the control and monitoring of service organisations prior to contributing to the development or operation of the cloud service.
The risk assessment includes the identification, analysis, evaluation, treatment and documentation of risks with regard to the following aspects:
- Protection needs regarding the confidentiality, integrity, availability and authenticity of cloud service customer data, cloud service derived data, cloud service provider data and account data processed, stored or transmitted by the service organisation;
- Impact of a protection breach on the provision of the cloud service;
- The cloud service provider's dependence on the service organisation for the scope, complexity and uniqueness of the provided service, including the consideration of possible alternatives;
- Complementary subservice organisation controls (CSOCs) assumed in the design of cloud service provider's controls to meet the applicable C5 criteria;
- Deviations regarding the design and operation of CSOCs assumed at service organisations considered as subservice organisations and mitigating measures by the cloud service provider to address such deviations;
- The ability of the cloud service provider to diversify sources of supply and limit vendor lock-in;
- Whether service organisations used by the cloud service provider themselves use subcontracted service organisations (subcontractors) that contribute to the development and operation of the cloud service; and
- If service organisations used by the cloud service provider themselves use subcontractors, the types of data processed by the subcontractors.
Supplementary information
For assessing risks with service organisations, the cloud service provider can perform coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products provided by service organisations. Apart from the aspects listed in this subcriterion, such a risk assessment should take into account technical and, where relevant, non-technical risk factors.
Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, cf. section 'Consideration of Subservice Organisations').
The adequacy of the risk assessment is reviewed regularly, at least annually, by qualified personnel of the cloud service provider during service usage.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources