C5 domain SSO: audit-ready control and monitoring of service organisations

This page covers the SSO domain (Control and Monitoring of Service Providers and Suppliers) of C5:2026, section 5.12 of the catalogue. How criteria and subcriteria are structured in general is explained on the page C5 criteria catalogue.

What is the SSO domain about?

SSO requires a control system for all service organisations that contribute to the development or operation of the service. The domain comprises eight criteria, SSO-01 to SSO-08, with 21 basic subcriteria, two sharpening and five complementing additional subcriteria. According to the BSI change history, three criteria are new compared with C5:2020: SSO-03, SSO-07 and SSO-08. The term supply chain does not appear in the subcriteria; the requirements on it are found there under service organisations and suppliers. The supplementary information on SSO-07 expressly assigns the criterion to the supply chain.

Two terms need to be kept apart. Service organisations are all partners, vendors or other third parties that provide you with services for the development or operation of the cloud service. Subservice organisations are only a subset of them: service organisations whose services are relevant to your customers’ understanding and at which you assume controls, the complementary subservice organisation controls (CSOC). For subservice organisations you choose the carve-out or inclusive method, see C5 scope; the criteria in SSO apply to all service organisations.

Starting point: a SaaS provider with many service organisations

Fictitious example, not a client. A provider runs a platform for video consultations used by medical practices and therapy centres. Around 30 employees, one product. The service runs on a cloud platform in Germany. In addition there are a relay service for video connections, an SMS and email service for sending appointment links, a service provider for the support hotline, a monitoring service, an agency for the further development of the app and a penetration tester. Until now, purchasing and contracts were handled by each team. The platform provider has a C5 report, the others have SOC 2 reports in some cases, ISO 27001 certificates in others, and nothing at all in some.

For a C5 attestation the provider now needs a system that treats all these relationships in the same way: classified by risk, bound by contract, monitored and evidenced.

Who is responsible for what: provider, platform, customer?

Responsibility stays with the provider. Even if it excludes a subservice organisation’s controls from the audit under the carve-out method, it remains responsible for the development and operation of the service meeting the criteria and monitors the subservice organisation under SSO-05 (section 3.4.6). Our classification for the example:

Under carve-out, the subservice organisations’ controls appear as information in the system description, and the auditor only checks whether these assumptions are fairly presented. If your service assumes that customers cooperate, describe this as complementary customer controls (complementary user entity controls, CUEC).

What does a control system for service organisations under SSO look like?

A cycle that every service organisation goes through, from the first offer to the end of the contract. The policy under SSO-01 sets the rules; the other criteria are the stages. The right-hand column is our recommendation of what should result at each stage.

SSO-01.01B no. 2 requires the determination of whether a service organisation is a subservice organisation as part of the policy; how to make it for each service organisation under section 3.4.6, complete the directory and evaluate your service organisations’ reports is shown on the page Subservice inventory. What of this goes into the system description is governed by minimum content item 8, see system description. Whether you have to name individual service organisations in the system description and what to do if a service organisation cannot provide an audit report is answered in the questions and answers on the page Subservice inventory.

Example control description for SSO-02

The assessment before use is where gaps arise most easily, because teams buy services themselves. This is how the control could look in the example; the template is our own wording, not catalogue text.

Whether the control covers the mapped subcriteria is for the auditor to assess. SSO-02.01B names eight aspects of the risk assessment; check your method against the wording in the catalogue.

What evidence the auditor wants to see

Documents setting out the rules and evidence that every stage was actually gone through during the period. Our overview for the example:

Possible gaps: cause, effect, remedy

We derive the gaps from the requirements of the catalogue; they are not auditor findings.

All criteria of the SSO domain

Titles as in the English version 1.0.1, number of subcriteria counted per section 5 (B = basic, AS = sharpening, AC = complementing). The column “What it covers” is our own short description, not catalogue text; the wording of the criteria in the catalogue is binding.

Linked with other domains: outsourced development is also governed by DEV (DEV-02), the involvement of service organisations in continuity tests by BCM (BCM-04).

Relationship to ISO/IEC 27001:2022 Annex A

The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3). The short labels are ours, not titles from the standard.