SSO · Control and Monitoring of Service Providers and Suppliers
SSO-06 Contract Termination Strategy for Service Organisations
Changed since C5:2020 · formerly SSO-05
Basic criterion
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
The Cloud Service Provider has defined and documented exit strategies for the purchase of services where the risk assessment of the service providers and suppliers regarding the scope, complexity and uniqueness of the purchased service resulted in a very high dependency (cf. Supplementary Information).
Exit strategies are aligned with operational continuity plans and include the following aspects:
- Analysis of the potential costs, impacts, resources and timing of the transition of a purchased service to an alternative service provider or supplier;
- Definition and allocation of roles, responsibilities and sufficient resources to perform the activities for a transition;
- Definition of success criteria for the transition;
- Definition of indicators for monitoring the performance of services, which should initiate the withdrawal from the service if the results are unacceptable.
Supplementary information on all sub-criteria
A very high dependency can be assumed in particular if the purchased service is indispensable for the provision of the cloud service. This situation is the case if the cloud service provider:
- Provides the cloud service from data centres operated by service organisations; or
- Provides a SaaS service and uses the IaaS or PaaS of another cloud service provider.
A very high dependency can also be assumed if the service cannot be obtained within one month from an alternative service organisation, as:
- It is unique on the market and no other service organisation can deliver it;
- It is strongly individualised by the service organisation and/or the cloud service provider;
- It cannot be supplied by any other service organisation in the required quality of service; or
- It requires specific knowledge that is only/mainly available to the current service organisation and not to the cloud service provider.
Exit strategies may vary in complexity based on the nature and degree of dependency of the cloud service on third party services and service organisations. Using a cloud service broker is an example of a complex scenario. Aspects listed in SSO-06.02B should be considered based on the results of the cloud service provider's risk assessment. Where a lower degree of dependency has been identified, exit strategies or individual aspects thereof are not mandatory in the sense of this criterion.
Basic criterion
The cloud service provider has defined and documented contract termination or exit strategies for the purchase of services where the risk assessment of the service organisations regarding the scope, complexity and uniqueness of the service provided resulted in a very high dependency (cf. Supplementary Information).
Exit strategies are aligned with operational continuity plans and include the following aspects:
- Analysis of the potential costs, impacts, resources and timing of the transition of a purchased service to an alternative service organisation;
- Definition and allocation of roles, responsibilities and sufficient resources to perform the activities for a transition;
- Definition of success criteria for the transition; and
- Definition of indicators for monitoring the performance of services, which should initiate the withdrawal from the service if the results are unacceptable.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources