BSI C5:2020 (Cloud Computing Compliance Criteria)

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 OPS-01 — Capacity Management - Planning
• BSI C5:2020 OPS-02 — Capacity Management - Monitoring
• BSI C5:2020 OPS-03 — Capacity Management - Controlling of Resources
• BSI C5:2020 OPS-04 — Protection Against Malware - Concept
• BSI C5:2020 OPS-05 — Protection Against Malware - Implementation

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 PSS-01 — Guidelines and Recommendations for Cloud Customers
• BSI C5:2020 PSS-02 — Identification of Vulnerabilities of the Cloud Service
• BSI C5:2020 PSS-03 — Online Register of Known Vulnerabilities
• BSI C5:2020 PSS-04 — Error handling and Logging Mechanisms
• BSI C5:2020 PSS-05 — Authentication Mechanisms

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 DEV-01 — Policies for the development/procurement of information systems
• BSI C5:2020 DEV-02 — Outsourcing of the development
• BSI C5:2020 DEV-03 — Policies for changes to information systems
• BSI C5:2020 DEV-04 — Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools.
• BSI C5:2020 DEV-05 — Risk assessment, categorisation and prioritisation of changes

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 IDM-01 — Policy for user accounts and access rights
• BSI C5:2020 IDM-02 — Granting and change of user accounts and access rights
• BSI C5:2020 IDM-03 — Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins
• BSI C5:2020 IDM-04 — Withdraw or adjust access rights as the task area changes
• BSI C5:2020 IDM-05 — Regular review of access rights

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 COS-01 — Technical safeguards
• BSI C5:2020 COS-02 — Security requirements for connections in the Cloud Service Provider's network
• BSI C5:2020 COS-03 — Monitoring of connections in the Cloud Service Provider's network
• BSI C5:2020 COS-04 — Cross-network access
• BSI C5:2020 COS-05 — Networks for administration

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 OIS-01 — Information Security Management System (ISMS)
• BSI C5:2020 OIS-02 — Information Security Policy
• BSI C5:2020 OIS-03 — Interfaces and Dependencies
• BSI C5:2020 OIS-04 — Segregation of Duties
• BSI C5:2020 OIS-05 — Contact with Relevant Government Agencies and Interest Groups

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 PS-01 — Physical Security and Environmental Control Requirements
• BSI C5:2020 PS-02 — Redundancy model
• BSI C5:2020 PS-03 — Perimeter Protection
• BSI C5:2020 PS-04 — Physical site access control
• BSI C5:2020 PS-05 — Protection against threats from outside and from the environment

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 AM-01 — Asset Inventory
• BSI C5:2020 AM-02 — Acceptable Use and Safe Handling of Assets Policy
• BSI C5:2020 AM-03 — Commissioning of Hardware
• BSI C5:2020 AM-04 — Decommissioning of Hardware
• BSI C5:2020 AM-05 — Commitment to Permissible Use, Safe Handling and Return of Assets

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 HR-01 — Verification of qualification and trustworthiness
• BSI C5:2020 HR-02 — Employment terms and conditions
• BSI C5:2020 HR-03 — Security training and awareness programme
• BSI C5:2020 HR-04 — Disciplinary measures
• BSI C5:2020 HR-05 — Responsibilities in the event of termination or change of employment

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 SIM-01 — Policy for security incident management
• BSI C5:2020 SIM-02 — Processing of security incidents
• BSI C5:2020 SIM-03 — Documentation and reporting of security incidents
• BSI C5:2020 SIM-04 — Duty of the users to report security incidents to a central body
• BSI C5:2020 SIM-05 — Evaluation and learning process

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 SSO-01 — Policies and instructions for controlling and monitoring third parties
• BSI C5:2020 SSO-02 — Risk assessment of service providers and suppliers
• BSI C5:2020 SSO-03 — Directory of service providers and suppliers
• BSI C5:2020 SSO-04 — Monitoring of compliance with requirements
• BSI C5:2020 SSO-05 — Exit strategy for the receipt of benefits

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 BCM-01 — Top management responsibility
• BSI C5:2020 BCM-02 — Business impact analysis policies and instructions
• BSI C5:2020 BCM-03 — Planning business continuity
• BSI C5:2020 BCM-04 — Verification, updating and testing of the business continuity

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 COM-01 — Identification of applicable legal, regulatory, self-imposed or contractual requirements
• BSI C5:2020 COM-02 — Policy for planning and conducting audits
• BSI C5:2020 COM-03 — Internal audits of the information security management system
• BSI C5:2020 COM-04 — Information on information security performance and management assessment of the ISMS

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 CRY-01 — Policy for the use of encryption procedures and key management
• BSI C5:2020 CRY-02 — Encryption of data for transmission (transport encryption)
• BSI C5:2020 CRY-03 — Encryption of sensitive data for storage
• BSI C5:2020 CRY-04 — Secure key management

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 INQ-01 — Legal Assessment of Investigative Inquiries
• BSI C5:2020 INQ-02 — INQ-02 Informing Cloud Customers about Investigation Requests
• BSI C5:2020 INQ-03 — Conditions for Access to or Disclosure of Data in Investigation Requests
• BSI C5:2020 INQ-04 — Limiting Access to or Disclosure of Data in Investigation Requests

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 PI-01 — Documentation and safety of input and output interfaces
• BSI C5:2020 PI-02 — Contractual agreements for the provision of data
• BSI C5:2020 PI-03 — Secure deletion of data

BSI C5:2020 (Cloud Computing Compliance Criteria)

• BSI C5:2020 SP-01 — Documentation, communication and provision of policies and instructions
• BSI C5:2020 SP-02 — Review and Approval of Policies and Instructions
• BSI C5:2020 SP-03 — Exceptions from Existing Policies and Instructions