BSI C5:2020 SP-03 — Exceptions from Existing Policies and Instructions

What this control requires

Manages exceptions to security policies through OIS-06 risk management, requiring risk owner approval and annual review. Documents time-limited exceptions to ensure controlled deviations, minimizing risks to cloud customer data while maintaining compliance with security standards.

In plain English

Manages exceptions to security policies through OIS-06 risk management, requiring risk owner approval and annual review. In practice, this means you can prove you risk security policy-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Security Policy Management, the assessor will trace your implementation back to the catalogue reference (Criterion SP-03) and look for objective evidence on the latest two assessment cycles.

How to implement

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Policy Management

Docs. Keep each policy in version-controlled Markdown alongside the code that implements it; ship a signed PDF snapshot at each annual review and link the SHA into the SoA.

Operational checklist

• Risk. Document the trigger, the owner and the cadence.
• Review. Document the trigger, the owner and the cadence.
• Exceptions. Document the trigger, the owner and the cadence.
• Security. Document the trigger, the owner and the cadence.
• Data. Document the trigger, the owner and the cadence.
• Scope: security policy, cloud customer data, management.

Evidence to collect

• Policy Document. A signed and version-controlled policy / standard / procedure document.
• Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Signed policy or standard documents the safeguard. Focus: Exceptions from Existing Policies and Instructions.

Common pitfalls

• Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.
• Policies that no engineer has read; the version in Confluence drifts from the version that's actually being enforced.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• HIPAA (45 CFR Part 164) 164.308(a)(5)(i) — Security Awareness and Training
• ISO/IEC 27001:2022 A.5.23 — Information security for use of cloud services
• NIST SP 800-53 Rev. 5 PL-2(3) — Plan And Coordinate With Other Organizational Entities
• NIST SP 800-171 Rev. 3 3.12.3 — Continuous Monitoring
• SOC 2 (2017 TSC) CC2.3 — External Communication on Internal Control Matters

Related controls in BSI C5:2020

• Criterion SP-02 — Review and Approval of Policies and Instructions
• Criterion SP-01 — Documentation, communication and provision of policies and instructions
• Criterion OIS-05 — Contact with Relevant Government Agencies and Interest Groups
• Criterion OIS-06 — Risk Management Policy
• Criterion HR-02 — Employment terms and conditions
• Criterion PI-01 — Documentation and safety of input and output interfaces

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion SP-03

Topics: governance riskcloud posturepolicy management