SSO · Control and Monitoring of Service Providers and Suppliers
SSO-04 Directory of Service Organisations
Changed since C5:2020 · formerly SSO-03
Basic criterion
Specified which data types the criterion applies to.
Specified address to mean the address of the head office.
Added the applicable legal jurisdiction as an information to be maintained in the directory.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
The Cloud Service Provider maintains a directory for controlling and monitoring the service providers and suppliers who contribute services to the delivery of the cloud service. The following information is maintained in the directory:
- Company name;
- Address;
- Locations of data processing and storage;
- Responsible contact person at the service provider/supplier;
- Responsible contact person at the cloud service provider;
- Description of the service;
- Classification based on the risk assessment;
- Beginning of service usage; and
- Proof of compliance with contractually agreed requirements.
The information in the list is checked at least annually for completeness, accuracy and validity.
Basic criterion
The cloud service provider maintains a directory for controlling and monitoring the service organisations that contribute services to the delivery of the cloud service. The following information is maintained in the directory:
- Company name;
- Address of the head office;
- Applicable legal jurisdiction;
- Locations where cloud service customer data, cloud service derived data, cloud service provider data and account data is processed and stored;
- Responsible contact group/person at the service organisation;
- Responsible contact group/person at the cloud service provider;
- Description of the service;
- Classification based on the risk assessment;
- Beginning of service usage; and
- Proof of compliance with contractually agreed requirements.
Supplementary information
It is not necessary to maintain a single central register in order to fulfil the basic criterion.
The inventory is reviewed at least annually for completeness, accuracy and validity of the information.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources