# SSO-08 Controlling Exchanges with Suppliers of Functional Components

- Domain: SSO – Control and Monitoring of Service Providers and Suppliers
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/sso-08/

**Supplementary information:**

A supplier of a functional component is typically a service organisation of the cloud service provider. The authorisation for the transfer may be automated. Content provided by the supplier refers to updates of the functional components.

## Basic criterion

### SSO-08.01B

When functional components used for the provision of the cloud service may directly or indirectly access cloud service customer data, the cloud service provider defines and implements a policy according to SP-01 that does not allow a direct exchange between such components and their suppliers.

### SSO-08.02B

In addition, procedures are defined and implemented according to SP-01 that require the cloud service provider to authorise any content provided by a supplier for its functional components or to be sent from a functional component to its supplier. The authorisation takes place before the content is transferred and for each transfer.

### SSO-08.03B

When a procedure for authorising content before its transfer is automated, the cloud service provider implements it using a solution that maintains traces of:

1. The operations that are proposed by the functional component's supplier;
2. The verification that is performed to authorise the content before its transfer; and
3. The transfers, both incoming and outgoing, that are effectively performed.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.