Domains

SSO

Control and Monitoring of Service Providers and Suppliers

8 criteria, 21 basic and 7 additional sub-criteria

• SSO-01Policies and Procedures for Controlling and Monitoring Service Organisations3 sub-criteria: 1 basic, 2 additional
• SSO-02Risk Assessment of Service Organisations2 sub-criteria
• SSO-03Data Processing of Service Organisations3 sub-criteria: 2 basic, 1 additional, new in C5:2026
• SSO-04Directory of Service Organisations2 sub-criteria
• SSO-05Monitoring of Compliance with Requirements10 sub-criteria: 7 basic, 3 additional, with customer criteria
• SSO-06Contract Termination Strategy for Service Organisations2 sub-criteria
• SSO-07Ensuring Transparency within Service Organisations3 sub-criteria: 2 basic, 1 additional, new in C5:2026
• SSO-08Controlling Exchanges with Suppliers of Functional Components3 sub-criteria, new in C5:2026

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources