# BSI C5:2020 (Cloud Computing Compliance Criteria) > The German Federal Office for Information Security's 2020 Cloud Computing Compliance Criteria Catalogue — the baseline German public-sector buyers and many DAX-listed enterprises expect from their cloud providers. Each criterion has Basic and Additional objectives; attestation is performed under ISAE 3000 / IDW PS 860 as a Type 1 or Type 2 report. - Source: https://support.icompaas.com/compliance/bsi-c5-2020 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## BSI C5:2020 (Cloud Computing Compliance Criteria): control library 121 controls in 17 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Asset Management (AM) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 AM-01 — Asset Inventory](https://support.icompaas.com/compliance/bsi-c5-2020/am-01-asset-inventory) - [BSI C5:2020 AM-02 — Acceptable Use and Safe Handling of Assets Policy](https://support.icompaas.com/compliance/bsi-c5-2020/am-02-acceptable-use-and-safe-handling-of-assets-policy) - [BSI C5:2020 AM-03 — Commissioning of Hardware](https://support.icompaas.com/compliance/bsi-c5-2020/am-03-commissioning-of-hardware) - [BSI C5:2020 AM-04 — Decommissioning of Hardware](https://support.icompaas.com/compliance/bsi-c5-2020/am-04-decommissioning-of-hardware) - [BSI C5:2020 AM-05 — Commitment to Permissible Use, Safe Handling and Return of Assets](https://support.icompaas.com/compliance/bsi-c5-2020/am-05-commitment-to-permissible-use-safe-handling-and-return-of-assets) - [BSI C5:2020 AM-06 — Asset Classification and Labelling](https://support.icompaas.com/compliance/bsi-c5-2020/am-06-asset-classification-and-labelling) ### Human Resources Security (HR) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 HR-01 — Verification of qualification and trustworthiness](https://support.icompaas.com/compliance/bsi-c5-2020/hr-01-verification-of-qualification-and-trustworthiness) - [BSI C5:2020 HR-02 — Employment terms and conditions](https://support.icompaas.com/compliance/bsi-c5-2020/hr-02-employment-terms-and-conditions) - [BSI C5:2020 HR-03 — Security training and awareness programme](https://support.icompaas.com/compliance/bsi-c5-2020/hr-03-security-training-and-awareness-programme) - [BSI C5:2020 HR-04 — Disciplinary measures](https://support.icompaas.com/compliance/bsi-c5-2020/hr-04-disciplinary-measures) - [BSI C5:2020 HR-05 — Responsibilities in the event of termination or change of employment](https://support.icompaas.com/compliance/bsi-c5-2020/hr-05-responsibilities-in-the-event-of-termination-or-change-of-employment) - [BSI C5:2020 HR-06 — Confidentiality agreements](https://support.icompaas.com/compliance/bsi-c5-2020/hr-06-confidentiality-agreements) ### Data Processing Interfaces (PI) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 PI-01 — Documentation and safety of input and output interfaces](https://support.icompaas.com/compliance/bsi-c5-2020/pi-01-documentation-and-safety-of-input-and-output-interfaces) - [BSI C5:2020 PI-02 — Contractual agreements for the provision of data](https://support.icompaas.com/compliance/bsi-c5-2020/pi-02-contractual-agreements-for-the-provision-of-data) - [BSI C5:2020 PI-03 — Secure deletion of data](https://support.icompaas.com/compliance/bsi-c5-2020/pi-03-secure-deletion-of-data) ### Physical Security (PS) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 PS-01 — Physical Security and Environmental Control Requirements](https://support.icompaas.com/compliance/bsi-c5-2020/ps-01-physical-security-and-environmental-control-requirements) - [BSI C5:2020 PS-02 — Redundancy model](https://support.icompaas.com/compliance/bsi-c5-2020/ps-02-redundancy-model) - [BSI C5:2020 PS-03 — Perimeter Protection](https://support.icompaas.com/compliance/bsi-c5-2020/ps-03-perimeter-protection) - [BSI C5:2020 PS-04 — Physical site access control](https://support.icompaas.com/compliance/bsi-c5-2020/ps-04-physical-site-access-control) - [BSI C5:2020 PS-05 — Protection against threats from outside and from the environment](https://support.icompaas.com/compliance/bsi-c5-2020/ps-05-protection-against-threats-from-outside-and-from-the-environment) - [BSI C5:2020 PS-06 — Protection against interruptions caused by power failures and other such risks](https://support.icompaas.com/compliance/bsi-c5-2020/ps-06-protection-against-interruptions-caused-by-power-failures-and-other-such-risks) - [BSI C5:2020 PS-07 — Surveillance of operational and environmental parameters](https://support.icompaas.com/compliance/bsi-c5-2020/ps-07-surveillance-of-operational-and-environmental-parameters) ### Security Policy Management (SP) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 SP-01 — Documentation, communication and provision of policies and instructions](https://support.icompaas.com/compliance/bsi-c5-2020/sp-01-documentation-communication-and-provision-of-policies-and-instructions) - [BSI C5:2020 SP-02 — Review and Approval of Policies and Instructions](https://support.icompaas.com/compliance/bsi-c5-2020/sp-02-review-and-approval-of-policies-and-instructions) - [BSI C5:2020 SP-03 — Exceptions from Existing Policies and Instructions](https://support.icompaas.com/compliance/bsi-c5-2020/sp-03-exceptions-from-existing-policies-and-instructions) ### Business Continuity Management (BCM) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 BCM-01 — Top management responsibility](https://support.icompaas.com/compliance/bsi-c5-2020/bcm-01-top-management-responsibility) - [BSI C5:2020 BCM-02 — Business impact analysis policies and instructions](https://support.icompaas.com/compliance/bsi-c5-2020/bcm-02-business-impact-analysis-policies-and-instructions) - [BSI C5:2020 BCM-03 — Planning business continuity](https://support.icompaas.com/compliance/bsi-c5-2020/bcm-03-planning-business-continuity) - [BSI C5:2020 BCM-04 — Verification, updating and testing of the business continuity](https://support.icompaas.com/compliance/bsi-c5-2020/bcm-04-verification-updating-and-testing-of-the-business-continuity) ### Compliance Management (COM) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 COM-01 — Identification of applicable legal, regulatory, self-imposed or contractual requirements](https://support.icompaas.com/compliance/bsi-c5-2020/com-01-identification-of-applicable-legal-regulatory-self-imposed-or-contractual) - [BSI C5:2020 COM-02 — Policy for planning and conducting audits](https://support.icompaas.com/compliance/bsi-c5-2020/com-02-policy-for-planning-and-conducting-audits) - [BSI C5:2020 COM-03 — Internal audits of the information security management system](https://support.icompaas.com/compliance/bsi-c5-2020/com-03-internal-audits-of-the-information-security-management-system) - [BSI C5:2020 COM-04 — Information on information security performance and management assessment of the ISMS](https://support.icompaas.com/compliance/bsi-c5-2020/com-04-information-on-information-security-performance-and-management-assessment-of-the) ### Communication & Network Security (COS) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 COS-01 — Technical safeguards](https://support.icompaas.com/compliance/bsi-c5-2020/cos-01-technical-safeguards) - [BSI C5:2020 COS-02 — Security requirements for connections in the Cloud Service Provider's network](https://support.icompaas.com/compliance/bsi-c5-2020/cos-02-security-requirements-for-connections-in-the-cloud-service-provider-s-network) - [BSI C5:2020 COS-03 — Monitoring of connections in the Cloud Service Provider's network](https://support.icompaas.com/compliance/bsi-c5-2020/cos-03-monitoring-of-connections-in-the-cloud-service-provider-s-network) - [BSI C5:2020 COS-04 — Cross-network access](https://support.icompaas.com/compliance/bsi-c5-2020/cos-04-cross-network-access) - [BSI C5:2020 COS-05 — Networks for administration](https://support.icompaas.com/compliance/bsi-c5-2020/cos-05-networks-for-administration) - [BSI C5:2020 COS-06 — Segregation of data traffic in jointly used network environments](https://support.icompaas.com/compliance/bsi-c5-2020/cos-06-segregation-of-data-traffic-in-jointly-used-network-environments) - [BSI C5:2020 COS-07 — Documentation of the network topology](https://support.icompaas.com/compliance/bsi-c5-2020/cos-07-documentation-of-the-network-topology) - [BSI C5:2020 COS-08 — Policies for data transmission](https://support.icompaas.com/compliance/bsi-c5-2020/cos-08-policies-for-data-transmission) ### Cryptography & Key Management (CRY) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 CRY-01 — Policy for the use of encryption procedures and key management](https://support.icompaas.com/compliance/bsi-c5-2020/cry-01-policy-for-the-use-of-encryption-procedures-and-key-management) - [BSI C5:2020 CRY-02 — Encryption of data for transmission (transport encryption)](https://support.icompaas.com/compliance/bsi-c5-2020/cry-02-encryption-of-data-for-transmission-transport-encryption) - [BSI C5:2020 CRY-03 — Encryption of sensitive data for storage](https://support.icompaas.com/compliance/bsi-c5-2020/cry-03-encryption-of-sensitive-data-for-storage) - [BSI C5:2020 CRY-04 — Secure key management](https://support.icompaas.com/compliance/bsi-c5-2020/cry-04-secure-key-management) ### Development & Change Management (DEV) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 DEV-01 — Policies for the development/procurement of information systems](https://support.icompaas.com/compliance/bsi-c5-2020/dev-01-policies-for-the-development-procurement-of-information-systems) - [BSI C5:2020 DEV-02 — Outsourcing of the development](https://support.icompaas.com/compliance/bsi-c5-2020/dev-02-outsourcing-of-the-development) - [BSI C5:2020 DEV-03 — Policies for changes to information systems](https://support.icompaas.com/compliance/bsi-c5-2020/dev-03-policies-for-changes-to-information-systems) - [BSI C5:2020 DEV-04 — Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools.](https://support.icompaas.com/compliance/bsi-c5-2020/dev-04-safety-training-and-awareness-programme-regarding-continuous-software-delivery-and) - [BSI C5:2020 DEV-05 — Risk assessment, categorisation and prioritisation of changes](https://support.icompaas.com/compliance/bsi-c5-2020/dev-05-risk-assessment-categorisation-and-prioritisation-of-changes) - [BSI C5:2020 DEV-06 — Testing changes](https://support.icompaas.com/compliance/bsi-c5-2020/dev-06-testing-changes) - [BSI C5:2020 DEV-07 — Logging of changes](https://support.icompaas.com/compliance/bsi-c5-2020/dev-07-logging-of-changes) - [BSI C5:2020 DEV-08 — Version Control](https://support.icompaas.com/compliance/bsi-c5-2020/dev-08-version-control) - [BSI C5:2020 DEV-09 — Approvals for provision in the production environment](https://support.icompaas.com/compliance/bsi-c5-2020/dev-09-approvals-for-provision-in-the-production-environment) - [BSI C5:2020 DEV-10 — Separation of environments](https://support.icompaas.com/compliance/bsi-c5-2020/dev-10-separation-of-environments) ### Identity & Access Management (IDM) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 IDM-01 — Policy for user accounts and access rights](https://support.icompaas.com/compliance/bsi-c5-2020/idm-01-policy-for-user-accounts-and-access-rights) - [BSI C5:2020 IDM-02 — Granting and change of user accounts and access rights](https://support.icompaas.com/compliance/bsi-c5-2020/idm-02-granting-and-change-of-user-accounts-and-access-rights) - [BSI C5:2020 IDM-03 — Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins](https://support.icompaas.com/compliance/bsi-c5-2020/idm-03-locking-and-withdrawal-of-user-accounts-in-the-event-of-inactivity-or-multiple) - [BSI C5:2020 IDM-04 — Withdraw or adjust access rights as the task area changes](https://support.icompaas.com/compliance/bsi-c5-2020/idm-04-withdraw-or-adjust-access-rights-as-the-task-area-changes) - [BSI C5:2020 IDM-05 — Regular review of access rights](https://support.icompaas.com/compliance/bsi-c5-2020/idm-05-regular-review-of-access-rights) - [BSI C5:2020 IDM-06 — Privileged access rights](https://support.icompaas.com/compliance/bsi-c5-2020/idm-06-privileged-access-rights) - [BSI C5:2020 IDM-07 — Access to cloud customer data](https://support.icompaas.com/compliance/bsi-c5-2020/idm-07-access-to-cloud-customer-data) - [BSI C5:2020 IDM-08 — Confidentiality of authentication information](https://support.icompaas.com/compliance/bsi-c5-2020/idm-08-confidentiality-of-authentication-information) - [BSI C5:2020 IDM-09 — Authentication mechanisms](https://support.icompaas.com/compliance/bsi-c5-2020/idm-09-authentication-mechanisms) ### Investigative Cooperation (INQ) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 INQ-01 — Legal Assessment of Investigative Inquiries](https://support.icompaas.com/compliance/bsi-c5-2020/inq-01-legal-assessment-of-investigative-inquiries) - [BSI C5:2020 INQ-02 — INQ-02 Informing Cloud Customers about Investigation Requests](https://support.icompaas.com/compliance/bsi-c5-2020/inq-02-inq-02-informing-cloud-customers-about-investigation-requests) - [BSI C5:2020 INQ-03 — Conditions for Access to or Disclosure of Data in Investigation Requests](https://support.icompaas.com/compliance/bsi-c5-2020/inq-03-conditions-for-access-to-or-disclosure-of-data-in-investigation-requests) - [BSI C5:2020 INQ-04 — Limiting Access to or Disclosure of Data in Investigation Requests](https://support.icompaas.com/compliance/bsi-c5-2020/inq-04-limiting-access-to-or-disclosure-of-data-in-investigation-requests) ### Information Security Governance (OIS) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 OIS-01 — Information Security Management System (ISMS)](https://support.icompaas.com/compliance/bsi-c5-2020/ois-01-information-security-management-system-isms) - [BSI C5:2020 OIS-02 — Information Security Policy](https://support.icompaas.com/compliance/bsi-c5-2020/ois-02-information-security-policy) - [BSI C5:2020 OIS-03 — Interfaces and Dependencies](https://support.icompaas.com/compliance/bsi-c5-2020/ois-03-interfaces-and-dependencies) - [BSI C5:2020 OIS-04 — Segregation of Duties](https://support.icompaas.com/compliance/bsi-c5-2020/ois-04-segregation-of-duties) - [BSI C5:2020 OIS-05 — Contact with Relevant Government Agencies and Interest Groups](https://support.icompaas.com/compliance/bsi-c5-2020/ois-05-contact-with-relevant-government-agencies-and-interest-groups) - [BSI C5:2020 OIS-06 — Risk Management Policy](https://support.icompaas.com/compliance/bsi-c5-2020/ois-06-risk-management-policy) - [BSI C5:2020 OIS-07 — Application of the Risk Management Policy](https://support.icompaas.com/compliance/bsi-c5-2020/ois-07-application-of-the-risk-management-policy) ### Operations Security (OPS) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 OPS-01 — Capacity Management - Planning](https://support.icompaas.com/compliance/bsi-c5-2020/ops-01-capacity-management-planning) - [BSI C5:2020 OPS-02 — Capacity Management - Monitoring](https://support.icompaas.com/compliance/bsi-c5-2020/ops-02-capacity-management-monitoring) - [BSI C5:2020 OPS-03 — Capacity Management - Controlling of Resources](https://support.icompaas.com/compliance/bsi-c5-2020/ops-03-capacity-management-controlling-of-resources) - [BSI C5:2020 OPS-04 — Protection Against Malware - Concept](https://support.icompaas.com/compliance/bsi-c5-2020/ops-04-protection-against-malware-concept) - [BSI C5:2020 OPS-05 — Protection Against Malware - Implementation](https://support.icompaas.com/compliance/bsi-c5-2020/ops-05-protection-against-malware-implementation) - [BSI C5:2020 OPS-06 — Data Protection and Recovery - Concept](https://support.icompaas.com/compliance/bsi-c5-2020/ops-06-data-protection-and-recovery-concept) - [BSI C5:2020 OPS-07 — Data Backup and Recovery - Monitoring](https://support.icompaas.com/compliance/bsi-c5-2020/ops-07-data-backup-and-recovery-monitoring) - [BSI C5:2020 OPS-08 — Data Backup and Recovery - Regular Testing](https://support.icompaas.com/compliance/bsi-c5-2020/ops-08-data-backup-and-recovery-regular-testing) - [BSI C5:2020 OPS-09 — Data Backup and Recovery - Storage](https://support.icompaas.com/compliance/bsi-c5-2020/ops-09-data-backup-and-recovery-storage) - [BSI C5:2020 OPS-10 — Logging and Monitoring - Concept](https://support.icompaas.com/compliance/bsi-c5-2020/ops-10-logging-and-monitoring-concept) - [BSI C5:2020 OPS-11 — Logging and Monitoring - Metadata Management Concept](https://support.icompaas.com/compliance/bsi-c5-2020/ops-11-logging-and-monitoring-metadata-management-concept) - [BSI C5:2020 OPS-12 — Logging and Monitoring - Access, Storage and Deletion](https://support.icompaas.com/compliance/bsi-c5-2020/ops-12-logging-and-monitoring-access-storage-and-deletion) - [BSI C5:2020 OPS-13 — Logging and Monitoring - Identification of Events](https://support.icompaas.com/compliance/bsi-c5-2020/ops-13-logging-and-monitoring-identification-of-events) - [BSI C5:2020 OPS-14 — Logging and Monitoring - Storage of the Logging Data](https://support.icompaas.com/compliance/bsi-c5-2020/ops-14-logging-and-monitoring-storage-of-the-logging-data) - [BSI C5:2020 OPS-15 — Logging and Monitoring - Accountability](https://support.icompaas.com/compliance/bsi-c5-2020/ops-15-logging-and-monitoring-accountability) - [BSI C5:2020 OPS-16 — Logging and Monitoring - Configuration](https://support.icompaas.com/compliance/bsi-c5-2020/ops-16-logging-and-monitoring-configuration) - [BSI C5:2020 OPS-17 — Logging and Monitoring - Availability of the Monitoring Software](https://support.icompaas.com/compliance/bsi-c5-2020/ops-17-logging-and-monitoring-availability-of-the-monitoring-software) - [BSI C5:2020 OPS-18 — Managing Vulnerabilities, Malfunctions and Errors - Concept](https://support.icompaas.com/compliance/bsi-c5-2020/ops-18-managing-vulnerabilities-malfunctions-and-errors-concept) - [BSI C5:2020 OPS-19 — Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests](https://support.icompaas.com/compliance/bsi-c5-2020/ops-19-managing-vulnerabilities-malfunctions-and-errors-penetration-tests) - [BSI C5:2020 OPS-20 — Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures](https://support.icompaas.com/compliance/bsi-c5-2020/ops-20-managing-vulnerabilities-malfunctions-and-errors-measurements-analyses-and) - [BSI C5:2020 OPS-21 — Involvement of Cloud customers in the event of incidents](https://support.icompaas.com/compliance/bsi-c5-2020/ops-21-involvement-of-cloud-customers-in-the-event-of-incidents) - [BSI C5:2020 OPS-22 — Testing and Documentation of known Vulnerabilities](https://support.icompaas.com/compliance/bsi-c5-2020/ops-22-testing-and-documentation-of-known-vulnerabilities) - [BSI C5:2020 OPS-23 — Managing Vulnerabilities, Malfunctions and Errors - System Hardening](https://support.icompaas.com/compliance/bsi-c5-2020/ops-23-managing-vulnerabilities-malfunctions-and-errors-system-hardening) - [BSI C5:2020 OPS-24 — Separation of Datasets in the Cloud Infrastructure](https://support.icompaas.com/compliance/bsi-c5-2020/ops-24-separation-of-datasets-in-the-cloud-infrastructure) ### Platform & Service Security (PSS) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 PSS-01 — Guidelines and Recommendations for Cloud Customers](https://support.icompaas.com/compliance/bsi-c5-2020/pss-01-guidelines-and-recommendations-for-cloud-customers) - [BSI C5:2020 PSS-02 — Identification of Vulnerabilities of the Cloud Service](https://support.icompaas.com/compliance/bsi-c5-2020/pss-02-identification-of-vulnerabilities-of-the-cloud-service) - [BSI C5:2020 PSS-03 — Online Register of Known Vulnerabilities](https://support.icompaas.com/compliance/bsi-c5-2020/pss-03-online-register-of-known-vulnerabilities) - [BSI C5:2020 PSS-04 — Error handling and Logging Mechanisms](https://support.icompaas.com/compliance/bsi-c5-2020/pss-04-error-handling-and-logging-mechanisms) - [BSI C5:2020 PSS-05 — Authentication Mechanisms](https://support.icompaas.com/compliance/bsi-c5-2020/pss-05-authentication-mechanisms) - [BSI C5:2020 PSS-06 — Session Management](https://support.icompaas.com/compliance/bsi-c5-2020/pss-06-session-management) - [BSI C5:2020 PSS-07 — Confidentiality of Authentication Information](https://support.icompaas.com/compliance/bsi-c5-2020/pss-07-confidentiality-of-authentication-information) - [BSI C5:2020 PSS-08 — Roles and Rights Concept](https://support.icompaas.com/compliance/bsi-c5-2020/pss-08-roles-and-rights-concept) - [BSI C5:2020 PSS-09 — Authorisation Mechanisms](https://support.icompaas.com/compliance/bsi-c5-2020/pss-09-authorisation-mechanisms) - [BSI C5:2020 PSS-10 — Software Defined Networking](https://support.icompaas.com/compliance/bsi-c5-2020/pss-10-software-defined-networking) - [BSI C5:2020 PSS-11 — Images for Virtual Machines and Containers](https://support.icompaas.com/compliance/bsi-c5-2020/pss-11-images-for-virtual-machines-and-containers) - [BSI C5:2020 PSS-12 — Locations of Data Processing and Storage](https://support.icompaas.com/compliance/bsi-c5-2020/pss-12-locations-of-data-processing-and-storage) ### Security Incident Management (SIM) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 SIM-01 — Policy for security incident management](https://support.icompaas.com/compliance/bsi-c5-2020/sim-01-policy-for-security-incident-management) - [BSI C5:2020 SIM-02 — Processing of security incidents](https://support.icompaas.com/compliance/bsi-c5-2020/sim-02-processing-of-security-incidents) - [BSI C5:2020 SIM-03 — Documentation and reporting of security incidents](https://support.icompaas.com/compliance/bsi-c5-2020/sim-03-documentation-and-reporting-of-security-incidents) - [BSI C5:2020 SIM-04 — Duty of the users to report security incidents to a central body](https://support.icompaas.com/compliance/bsi-c5-2020/sim-04-duty-of-the-users-to-report-security-incidents-to-a-central-body) - [BSI C5:2020 SIM-05 — Evaluation and learning process](https://support.icompaas.com/compliance/bsi-c5-2020/sim-05-evaluation-and-learning-process) ### Supplier & Service Oversight (SSO) BSI C5:2020 (Cloud Computing Compliance Criteria) - [BSI C5:2020 SSO-01 — Policies and instructions for controlling and monitoring third parties](https://support.icompaas.com/compliance/bsi-c5-2020/sso-01-policies-and-instructions-for-controlling-and-monitoring-third-parties) - [BSI C5:2020 SSO-02 — Risk assessment of service providers and suppliers](https://support.icompaas.com/compliance/bsi-c5-2020/sso-02-risk-assessment-of-service-providers-and-suppliers) - [BSI C5:2020 SSO-03 — Directory of service providers and suppliers](https://support.icompaas.com/compliance/bsi-c5-2020/sso-03-directory-of-service-providers-and-suppliers) - [BSI C5:2020 SSO-04 — Monitoring of compliance with requirements](https://support.icompaas.com/compliance/bsi-c5-2020/sso-04-monitoring-of-compliance-with-requirements) - [BSI C5:2020 SSO-05 — Exit strategy for the receipt of benefits](https://support.icompaas.com/compliance/bsi-c5-2020/sso-05-exit-strategy-for-the-receipt-of-benefits)