# SSO-04 Directory of Service Organisations

- Domain: SSO – Control and Monitoring of Service Providers and Suppliers
- Since C5:2020: changed (formerly SSO-03)
- Web page: https://c5.patrickscheid.de/en/sso-04/

## Basic criterion

### SSO-04.01B

The cloud service provider maintains a directory for controlling and monitoring the service organisations that contribute services to the delivery of the cloud service. The following information is maintained in the directory:

1. Company name;
2. Address of the head office;
3. Applicable legal jurisdiction;
4. Locations where cloud service customer data, cloud service derived data, cloud service provider data and account data is processed and stored;
5. Responsible contact group/person at the service organisation;
6. Responsible contact group/person at the cloud service provider;
7. Description of the service;
8. Classification based on the risk assessment;
9. Beginning of service usage; and
10. Proof of compliance with contractually agreed requirements.

**Supplementary information:**

It is not necessary to maintain a single central register in order to fulfil the basic criterion.

### SSO-04.02B

The inventory is reviewed at least annually for completeness, accuracy and validity of the information.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Specified address to mean the address of the head office.

Added the applicable legal jurisdiction as an information to be maintained in the directory.

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.