SSO · Control and Monitoring of Service Providers and Suppliers
SSO-07 Ensuring Transparency within Service Organisations
New in C5:2026
Basic criterion
The cloud service provider designs, implements and maintains controls to ensure transparency within its service organisations with respect to the following aspects:
- Data flow and interfaces between the cloud service provider and service organisations used by the cloud service provider are documented, including measures regarding the secure transmission and access control for data shared with service organisations; and
- Cloud service customers are informed of service organisations used by the cloud service provider for development and operation of the cloud service and what type of data these service organisations and their subcontractors are processing.
Cloud service customers are informed which of the service organisations themselves use subcontractors to process cloud service customer data.
Supplementary information
This criterion addresses the need for managing supply chain risks (e.g. service organisation vulnerabilities, data handling practices, compliance gaps or operational disruptions) and for those risks to be communicated to cloud service customers, enabling them to monitor and manage their own supply chain risks effectively.
The cloud service provider documents this information and reviews its completeness, accuracy and validity at least annually.
Additional criterion
SSO-07.01AS
Additional, sharpens01BThe cloud service provider designs, implements and maintains controls to ensure transparency within its service organisations with respect to the following aspects:
- Data flow and interfaces between the cloud service provider and service organisations used by the cloud service provider are documented, including measures regarding the secure transmission and access control for data shared with service organisations; and
- Cloud service customers are informed of service organisations and their subcontractors used by the cloud service provider for development and operation of the cloud service and what type of data these service organisations and their subcontractors are processing.
Cloud service customers are informed which of the service organisations themselves use subcontractors to process cloud service customer data.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources