SSO · Control and Monitoring of Service Providers and Suppliers
SSO-08 Controlling Exchanges with Suppliers of Functional Components
New in C5:2026
Supplementary information on all sub-criteria
A supplier of a functional component is typically a service organisation of the cloud service provider. The authorisation for the transfer may be automated. Content provided by the supplier refers to updates of the functional components.
Basic criterion
When functional components used for the provision of the cloud service may directly or indirectly access cloud service customer data, the cloud service provider defines and implements a policy according to SP-01 that does not allow a direct exchange between such components and their suppliers.
In addition, procedures are defined and implemented according to SP-01 that require the cloud service provider to authorise any content provided by a supplier for its functional components or to be sent from a functional component to its supplier. The authorisation takes place before the content is transferred and for each transfer.
When a procedure for authorising content before its transfer is automated, the cloud service provider implements it using a solution that maintains traces of:
- The operations that are proposed by the functional component's supplier;
- The verification that is performed to authorise the content before its transfer; and
- The transfers, both incoming and outgoing, that are effectively performed.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources