# SSO-02 Risk Assessment of Service Organisations

- Domain: SSO – Control and Monitoring of Service Providers and Suppliers
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/sso-02/

## Basic criterion

### SSO-02.01B

Service organisations of the cloud service provider undergo a risk assessment in accordance with the policies and procedures for the control and monitoring of service organisations prior to contributing to the development or operation of the cloud service.

The risk assessment includes the identification, analysis, evaluation, treatment and documentation of risks with regard to the following aspects:

1. Protection needs regarding the confidentiality, integrity, availability and authenticity of cloud service customer data, cloud service derived data, cloud service provider data and account data processed, stored or transmitted by the service organisation;
2. Impact of a protection breach on the provision of the cloud service;
3. The cloud service provider's dependence on the service organisation for the scope, complexity and uniqueness of the provided service, including the consideration of possible alternatives;
4. Complementary subservice organisation controls (CSOCs) assumed in the design of cloud service provider's controls to meet the applicable C5 criteria;
5. Deviations regarding the design and operation of CSOCs assumed at service organisations considered as subservice organisations and mitigating measures by the cloud service provider to address such deviations;
6. The ability of the cloud service provider to diversify sources of supply and limit vendor lock-in;
7. Whether service organisations used by the cloud service provider themselves use subcontracted service organisations (subcontractors) that contribute to the development and operation of the cloud service; and
8. If service organisations used by the cloud service provider themselves use subcontractors, the types of data processed by the subcontractors.

**Supplementary information:**

For assessing risks with service organisations, the cloud service provider can perform coordinated security risk assessments of specific critical ICT services, ICT systems or ICT products provided by service organisations. Apart from the aspects listed in this subcriterion, such a risk assessment should take into account technical and, where relevant, non-technical risk factors.

Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, cf. section 'Consideration of Subservice Organisations').

### SSO-02.02B

The adequacy of the risk assessment is reviewed regularly, at least annually, by qualified personnel of the cloud service provider during service usage.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Changed the order of the requirements within the criterion.

Extended the aspects to be included in the risk assessment by the assumed CSOCs, deviations from assumed CSOCs, the ability to avoid vendor lock-ins, the use of subcontractors by the subservice organisations and the types of data processed by such subcontractors.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.