SSO · Control and Monitoring of Service Providers and Suppliers
SSO-05 Monitoring of Compliance with Requirements
Changed since C5:2020 · formerly SSO-04
Basic criterion
Specified third parties to which this criterion applies to be service organisations.
Extend the information to be reviewed as part of the monitoring by information on the compliance of the service organisation's subcontractors.
Removed requirement to include monitoring results in the review of the service organisation's risk assessment.
Added further requirements to assess subservice organisations and their relationship with the cloud service provider.
Added requirements regarding the notification of cloud service customers in case of security-relevant changes of service organisations.
Added requirements regarding the review of confidentiality agreements with suppliers.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Added requirement for the cloud service provider to conduct periodic security assessments for all service organisations.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
The Cloud Service Provider monitors compliance with information security requirements and applicable legal and regulatory requirements in accordance with policies and instructions concerning controlling and monitoring of third-parties.
Monitoring includes a regular review of the following evidence to the extent that such evidence is to be provided by third parties in accordance with the contractual agreements:
- reports on the quality of the service provided;
- certificates of the management systems' compliance with international standards;
- independent third-party reports on the suitability and operating effectiveness of their service-related internal control systems; and
- Records of the third parties on the handling of vulnerabilities, security incidents and malfunctions.
The frequency of the monitoring corresponds to the classification of the third party based on the risk assessment conducted by the Cloud Service Provider (cf. SSO-02). The results of the monitoring are included in the review of the third party's risk assessment.
Identified violations and deviations are subjected to analysis, evaluation and treatment in accordance with the risk management procedure (cf. OIS-07).
Additional criterion
The procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects:
- Configuration of system components;
- Performance and availability of system components;
- Response time to malfunctions and security incidents; and
- Recovery time (time until completion of error handling).
Identified violations and discrepancies are automatically reported to the responsible personnel or system components of the Cloud Service Provider for prompt assessment and action.
Supplementary information on all sub-criteria
Information obtained for monitoring of the design and operations of the service-related system of internal control typically includes reports in accordance with ISAE 3402, IDW PS 951, SOC 2 or BSI C5, ANSSI SecNumCloud or CSA CCM. Second party audits based on such frameworks may be useful here. For analysing BSI C5 reports in a structured manner, BSI has published an Excel-based evaluation guideline.
If such reports are provided by the service organisations, the cloud service provider reviews, for example, the following aspects and, if necessary, incorporates the findings into the risk assessment in order to derive and initiate mitigating actions:
- The scope and the validity respectively the period covered by the report;
- Modifications of the opinion, deviations/exceptions noted and management's response thereon;
- Complementary User Entity Controls (CUEC) to be designed and operated by the cloud service provider;
- Disclosed subservice organisations incl. any changes among those (e.g. additional subservice organisations); and
- Stated security incidents.
Information on CSOC has to be obtained for subservice organisations only. Not every service organisation is a subservice organisation, cf. section 'Consideration of Subservice Organisations'). Appropriate procedures may comprise the review of independent third party reports, or audit procedures performed by the cloud service provider at the subservice organisation.
The automated monitoring procedures outlined in the additional criterion are only applicable to service organisations for which monitoring automation is feasible based on the nature of the services provided to the cloud service provider.
Basic criterion
The cloud service provider monitors compliance with information security requirements and applicable legal and regulatory requirements in accordance with policies and procedures concerning controlling and monitoring of service organisation.
Monitoring includes a regular review of the following information to the extent that such information is to be provided by service organisations in accordance with the contractual agreements:
- Reports on the quality of the service provided;
- Certificates of the management systems' compliance with international standards;
- Records of the service organisations on the handling of vulnerabilities, security incidents and incidents;
- Independent third party reports on the design and operation of their service-related system of internal control; and
- If service organisations used by the cloud service provider themselves use subcontractors, the compliance of their subcontractors with relevant contractual, legal and regulatory requirements.
Supplementary information
When reviewing the information provided by the service organisation, the cloud service provider should distinguish between flawed information that was produced in good faith (such as reports about perceived security concerns that eventually turned out to be ill-founded), and deliberately false or malicious information.
Monitoring of subcontractors can occur via audits, certifications and third party reports (cf. SSO-05) and may be performed by the service organisations of the cloud service provider. The cloud service provider remains responsible for reviewing the results of compliance monitoring and assessing the risk.
The frequency of the monitoring corresponds to the classification of the service organisation based on the risk assessment conducted by the cloud service provider (cf. SSO-02).
If a service organisation is considered to be a subservice organisation, the cloud service provider assesses this relationship and carries out appropriate procedures to ensure that the applicable C5 criteria are met. Appropriate procedures provide reasonable assurance:
- That the subservice organisation has designed and operated relevant controls; and
- That the subservice organisation's controls correspond to the expected complementary subservice organisation controls (CSOCs) assumed in the design of the cloud service providers controls.
Identified deviations are subjected to analysis, evaluation and treatment in accordance with the risk assessment of service organisations (cf. SSO-02).
If a service organisation contributing to the provision of the cloud service undergoes a change that has a significant adverse effect on the cloud service provider's level of security, the cloud service provider communicates this to all of its cloud service customers without undue delay.
The cloud service provider establishes and documents a procedure to regularly review non-disclosure or confidentiality requirements for all service organisations involved in providing the cloud service. This procedure is implemented in practice, and the review is conducted at least once per year.
Additional criterion
SSO-05.01AC
Additional, complementingThe procedures for monitoring compliance with the requirements are supplemented by automatic procedures relating to the following aspects:
- Configuration of system components;
- Performance and availability of system components;
- Response time to incidents and security incidents; and
- Recovery time (time until completion of error handling).
SSO-05.02AC
Additional, complementingIdentified violations and discrepancies are automatically reported to the responsible personnel or system components of the cloud service provider for prompt assessment and action.
SSO-05.03AC
Additional, complementingThe cloud service provider defines and implements a process for conducting periodic security assessments for all service organisations. The nature and scope of these security assessments correspond to the risk associated with each service organisation. These risk-based security assessments ensure that service organisations meet the required security standards and that any potential risks are identified and mitigated appropriately.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they stay informed about subservice organisations of their cloud service provider (e.g. on the basis of the information in the C5 attestation report) and decide on the basis of their protection need of their data processed and stored in the cloud service whether further action should be taken to monitor and check these subservice organisations.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources