Completing the C5 subservice inventory and keeping it current

The inventory is a work product, not a catalogue term. The catalogue requires a directory of service organisations (SSO-04) and, in the system description, details on the subservice organisations (section 3.4.5.1 no. 8 and 3.4.6). We recommend keeping both in one table, because the subservice organisations are a subset of the service organisations. How the control system for service organisations works as a whole is explained on the page SSO domain; a blank template is on the page C5 templates.

Which details belong in the subservice inventory?

The details from two places in the catalogue, plus the fields you need for monitoring. The column “Source” shows where a detail comes from; the completion notes are our recommendation.

The template on the page C5 templates contains all of these fields, including the details under SSO-04. The catalogue does not require a single central register (supplementary information on SSO-04); you can also keep individual details in your contract register and refer to them from there.

Step 1: find all service organisations

The directory covers all service organisations that contribute services to delivering the cloud service, including small tools. A query in purchasing alone misses tools that teams order themselves. Our recommendation for the sources to build the list from:

• supplier list and credit card statements for the last twelve months,
• data processing agreements,
• data flow diagram and architecture documentation, including backup, logging, monitoring and email delivery,
• third-party applications connected to the identity service and pipeline integrations,
• outbound connections from the production environment.

Service organisations that contribute nothing to the development or operation of the service, such as payroll accounting, do not belong in the directory.

Step 2: Is a service organisation a subservice organisation?

A service organisation is a subservice organisation if two characteristics are present together; the catalogue says they “apply in combination” (section 3.4.6):

1. Its service is likely to be relevant to your customers’ understanding of how the service is built and how you meet the criteria; this is the case, for example, if it contributes to or has access to system components, may access confidential information or exchanges information with the service.
2. You need controls at the service organisation, the complementary subservice organisation controls (CSOC), to meet the criteria with reasonable assurance in combination with your own controls.

Characteristic 1 alone is therefore not enough. If your own controls, including your monitoring of the service organisation, meet the applicable criteria with reasonable assurance, it is not a subservice organisation, even if it sees customer data. For some cases the catalogue sets the direction:

• Data centres operated by third parties: generally subservice organisations, in particular for the criteria on physical security (PS).
• Infrastructure or platform of another cloud service provider: likewise, for example for operations (OPS).
• Cleaning companies, advertising agencies: typically not subservice organisations.

For all other service organisations, your own assessment decides. Our recommendation for characteristic 2: note the criteria concerned for each service organisation and ask, criterion by criterion, whether your own controls meet it without a control at the service organisation. Examples are encryption with keys that only you manage, technically removing personal content before transfer, or time-limited, logged test accounts. If a gap remains that only the service organisation can close, it is a subservice organisation, and exactly these controls are the CSOC. Record the result and the justification in the inventory; the auditor has to be able to follow the classification.

The classification has consequences. For each subservice organisation, the system description contains the details under minimum content item 8, and you choose carve-out or inclusive; the trade-off is on the page C5 scope. Under SSO-05 you have to monitor all service organisations, and even with carve-out you remain accountable for your service meeting the applicable criteria (section 3.4.6). How the control system for service organisations is built as a whole is explained on the page SSO domain.

A completed example

Fictitious example, not a client; all company names are made up. A provider runs applicant management software as SaaS for medium-sized companies. Application documents, CVs and communication with applicants are held in the service. The directory has six entries.

Part A: directory and classification

Part B: details on the subservice organisations

What goes from Part A and Part B into the system description is set by minimum content item 8: for each subservice organisation the nature of the service with contracting party, location, dependency and availability of C5 reports, plus the expected controls and your monitoring controls. The other service organisations stay in the internal directory. How the sections of the description are structured is shown on the page System description.

How do you review your subservice organisations’ audit reports?

With a fixed review scheme and a record for each report. According to the BSI FAQ, an unmodified audit opinion does not mean there are no deviations; only the review shows what the report covers for your service. The supplementary information on SSO-05 lists review points, among them scope and period, modifications of the opinion and deviations, the service organisation’s complementary user entity controls (CUEC), disclosed subservice organisations and stated security incidents. Our review scheme builds on this:

For analysing C5 reports in a structured manner, the catalogue mentions an Excel-based evaluation guideline published by the BSI. The BSI FAQ currently refers to documents for C5:2020 for this, with an update for C5:2026 announced (retrieved 1 November 2026). You receive the report itself from the service organisation; according to the BSI FAQ, the provider as owner decides on the conditions under which it is passed on. Customers read a C5 report with a different aim, namely for their own risk decision; here the subject is your monitoring under SSO-05.

A review record for the platform report in the example could look like this (fictitious values): compute, database and object storage services included, region included; the report period ends three months before the end of your own audit period, written confirmation requested; one deviation in the disposal of storage media with management’s response and correction in the following month, assessment: no effect on your own criteria because data is stored encrypted; 14 CUEC in the report, twelve mapped to your own controls, two open and recorded as actions with a deadline.

How do you keep the inventory current?

With fixed dates and triggers, some of which the catalogue sets. The frequencies in the right-hand column that go beyond the catalogue requirements are our recommendation.

For a type 2 report, the auditor needs evidence that these steps ran throughout the period: dated review records, review notes on the directory and completed actions. New subservice organisations during the period can also be a significant change that belongs in the system description, see Significant changes and events.

Common mistakes in the inventory