C5 domain COM: requirements, audits and management review ready for audit

This page covers the COM domain (Compliance) of C5:2026, section 5.15 of the catalogue. How criteria and subcriteria are structured in general is explained on the page C5 criteria catalogue.

What is the COM domain about?

COM is meant to avoid non-compliance with legal, regulatory, self-imposed or contractual information security requirements and to check compliance (objective in section 5.15). The domain is the provider’s audit cycle: identify requirements, plan audits, audit internally, inform management.

It comprises four criteria, COM-01 to COM-04, with 7 basic subcriteria, one sharpening and 7 complementing additional subcriteria. All four already existed in C5:2020. According to the BSI change history, the basic criteria of COM-01 and COM-04 are unchanged; their additional criteria are new. COM-02 now requires an audit programme over multiple years and names configuration reviews, penetration tests and source code reviews; COM-03 additionally checks the effectiveness of organisational and operational measures and requires a separation of the line of authority between auditors and the audited.

If you run an ISMS under ISO/IEC 27001, you have a good basis for COM-03 and COM-04; the catalogue itself refers to clauses 9.2 (internal audits) and 9.3 (management review) of the standard. What can be taken over from ISO 27001 overall is shown on the page C5 and ISO 27001.

Starting point: an ISO 27001-certified SaaS provider with a small team

Fictitious example, not a client. A provider runs fleet management software for companies as SaaS: vehicle data, driving licence checks, damage reports and fuel cards. The service runs on the infrastructure of a large cloud service provider. 25 employees, an ISO 27001 certificate for development and operations. A leasing group requires a C5 type 2 report and its own audit right in the contract.

Before the project, the situation looks like this:

• There is a register of legal requirements, but it only lists data protection and commercial law. Contractual commitments to customers, such as certificates and deadlines from framework agreements, are only found in the contracts.
• The information security officer plans the internal audits anew every year. There is no plan beyond the current year.
• The information security officer reports to the head of operations and also audits operations.
• Last year the annual penetration test ran at the end of the month, when customers generate their billing; the service was slow for an hour.
• The management review takes place annually, but the minutes contain no information security metrics.

Who is responsible for what: provider, platform, customer?

COM lies with the provider; the platform, in the example a subservice organisation, runs its own compliance programme. The customer only plays a part in COM-02. Our classification for the example:

Only COM-02 contains complementary customer criteria. Whichever customer controls you assume belong in the system description as complementary customer controls (CUEC). The auditor does not test them at the customer, only whether they are fairly presented.

What does a multi-year audit programme look like?

COM-02.01B requires a documented and implemented audit programme over multiple years that defines the scope and frequency of the audits and takes into account the management of change, policies and the results of the risk assessment. The catalogue gives a time frame of three years with internal and external audits as an example; the sharpening subcriterion COM-02.01AS prescribes exactly three years. For our example, the compliance audit plan could look like this (own proposal, not catalogue text):

Under COM-02.02B this includes a risk-based policy that prevents adverse effects of audits on operations, among other things through read-only access, performing risky activities in maintenance windows or outside peak periods, and logging of the audit activities. In the example, this rule would have prevented the penetration test at the end of the month. You prepare the external C5 follow-up audit itself separately, see C5 follow-up audit.

Example control description for COM-03

COM-03 requires internal audits at least annually by subject matter experts that check compliance with the policies and the effectiveness of the measures against the risks to network and information systems (COM-03.01B). The auditors are not in the line of authority of the area under review; if the size of the provider does not allow this, alternative measures ensure impartiality (COM-03.02B). Findings are subjected to a risk assessment and tracked (COM-03.03B). Our example control for the provider above (own wording, not catalogue text):

The solution with external support for one area is one of several conceivable alternative measures; clarify early with the auditor which one they consider sufficient. For a type 2 report the auditor also tests whether the control operated effectively throughout the period.

What evidence the auditor wants to see

COM evidence consists mainly of ISMS documents. The timing matters: the programme, the reports and the management review must have been valid or have taken place in the audit period. Examples from our scenario:

The register under COM-01 does not have to be a single register; according to the supplementary information it may be spread across several documents. How to maintain such evidence across domains is shown on the page Evidence and documentation.

Possible gaps: cause, effect, remedy

The following gaps follow from the wording of the criteria and the scenario above. If a single subcriterion is not met, the criterion counts as not met, and the auditor reports the deviation (sections 3.4.12 and 3.4.13).

How to put these gaps in order together with those of other domains is shown on the page Prioritising measures.

All criteria of the COM domain

Titles as in the English version 1.0.1, number of subcriteria counted per section 5 (B = basic, AS = sharpening, AC = complementing). The column “What it covers” is our own short description, not catalogue text; the wording of the criteria in the catalogue is binding.

Additional criteria with an effect on sales include COM-01.01AC (overview of the procedures for compliance on customer request), COM-02.01AC (contractually agreed information and audit rights, also as a group audit) and COM-03.03AC (interfaces through which customers check compliance with selected contractual agreements in real time). In the example, the leasing group requires an audit right, so COM-02.01AC is an obvious candidate.

Relationship to ISO/IEC 27001:2022

COM largely reflects requirements from the main body of the standard, not only from Annex A. The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3). The short labels are ours, not titles from the standard.