BSI C5 (Germany): the evidence behind every control

121 controls. For each, the artefacts auditors ask for, which ones a system already holds, and the first move to stop evidencing it by periodic review.

C5: Asset Management

AM-01Asset Inventory moderate AM-02Acceptable Use and Safe Handling of Assets Policy easy AM-03Commissioning of Hardware moderate AM-04Decommissioning of Hardware moderate AM-05Commitment to Permissible Use, Safe Handling and Return of Assets hard AM-06Asset Classification and Labelling moderate

C5: Business Continuity Management

BCM-01Top management responsibility hard BCM-02Business impact analysis policies and instructions hard BCM-03Planning business continuity hard BCM-04Verification, updating and testing of the business continuity hard

C5: Compliance

COM-01Identification of applicable legal, regulatory, self-imposed or contractual requirements hard COM-02Policy for planning and conducting audits moderate COM-03Internal audits of the information security management system hard COM-04Information on information security performance and management assessment of the ISMS hard

C5: Communication Security

COS-01Technical safeguards easy COS-02Security requirements for connections in the Cloud Service Provider's network moderate COS-03Monitoring of connections in the Cloud Service Provider's network hard COS-04Cross-network access hard COS-05Networks for administration easy COS-06Segregation of data traffic in jointly used network environments moderate COS-07Documentation of the network topology hard COS-08Policies for data transmission hard

C5: Cryptography and Key Management

CRY-01Policy for the use of encryption procedures and key management hard CRY-02Encryption of data for transmission (transport encryption) easy CRY-03Encryption of sensitive data for storage hard CRY-04Secure key management hard

C5: Procurement, Development and Modification of Information Systems

DEV-01Policies for the development/procurement of information systems hard DEV-02Outsourcing of the development hard DEV-03Policies for changes to information systems hard DEV-04Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools hard DEV-05Risk assessment, categorisation and prioritisation of changes hard DEV-06Testing changes moderate DEV-07Logging of changes easy DEV-08Version Control hard DEV-09Approvals for provision in the production environment moderate DEV-10Separation of environments hard

C5: Human Resources

HR-01Verification of qualification and trustworthiness moderate HR-02Employment terms and conditions hard HR-03Security training and awareness programme easy HR-04Disciplinary measures hard HR-05Responsibilities in the event of termination or change of employment moderate HR-06Confidentiality agreements hard

C5: Identity and Access Management

IDM-01Policy for user accounts and access rights hard IDM-02Granting and change of user accounts and access rights easy IDM-03Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins moderate IDM-04Withdraw or adjust access rights as the task area changes moderate IDM-05Regular review of access rights moderate IDM-06Privileged access rights moderate IDM-07Access to cloud customer data moderate IDM-08Confidentiality of authentication information hard IDM-09Authentication mechanisms hard

C5: Dealing with Investigation Requests from Government Agencies

INQ-01Legal Assessment of Investigative Inquiries moderate INQ-02Informing Cloud Customers about Investigation Requests moderate INQ-03Conditions for Access to or Disclosure of Data in Investigation Requests moderate INQ-04Limiting Access to or Disclosure of Data in Investigation Requests hard

C5: Organisation of Information Security

OIS-01Information Security Management System (ISMS) hard OIS-02Information Security Policy hard OIS-03Interfaces and Dependencies hard OIS-04Segregation of Duties moderate OIS-05Contact with Relevant Government Agencies and Interest Groups moderate OIS-06Risk Management Policy moderate OIS-07Application of the Risk Management Policy hard

C5: Operations

OPS-01Capacity Management - Planning hard OPS-02Capacity Management - Monitoring moderate OPS-03Capacity Management - Controlling of Resources hard OPS-04Protection Against Malware - Concept moderate OPS-05Protection Against Malware - Implementation easy OPS-06Data Backup and Recovery - Concept hard OPS-07Data Backup and Recovery - Monitoring easy OPS-08Data Backup and Recovery - Regular Testing moderate OPS-09Data Backup and Recovery - Storage moderate OPS-10Logging and Monitoring - Concept moderate OPS-11Logging and Monitoring - Metadata Management Concept hard OPS-12Logging and Monitoring - Access, Storage and Deletion easy OPS-13Logging and Monitoring - Identification of Events easy OPS-14Logging and Monitoring - Storage of the Logging Data easy OPS-15Logging and Monitoring - Accountability moderate OPS-16Logging and Monitoring - Configuration easy OPS-17Logging and Monitoring - Availability of the Monitoring Software easy OPS-18Managing Vulnerabilities, Malfunctions and Errors - Concept hard OPS-19Managing Vulnerabilities, Malfunctions and Errors - Penetration Tests hard OPS-20Managing Vulnerabilities, Malfunctions and Errors - Measurements, Analyses and Assessments of Procedures hard OPS-21Involvement of Cloud Customers in the Event of Incidents hard OPS-22Testing and Documentation of known Vulnerabilities easy OPS-23Managing Vulnerabilities, Malfunctions and Errors - System Hardening easy OPS-24Separation of Datasets in the Cloud Infrastructure easy

C5: Portability and Interoperability

PI-01Documentation and safety of input and output interfaces moderate PI-02Contractual agreements for the provision of data hard PI-03Secure deletion of data hard

C5: Physical Security

PS-01Physical Security and Environmental Control Requirements hard PS-02Redundancy model hard PS-03Perimeter Protection hard PS-04Physical site access control easy PS-05Protection from fire and smoke hard PS-06Protection against interruptions caused by power failures and other such risks hard PS-07Surveillance of operational and environmental parameters easy

C5: Product Safety and Security

PSS-01Guidelines and Recommendations for Cloud Customers moderate PSS-02Identification of Vulnerabilities of the Cloud Service easy PSS-03Online Register of Known Vulnerabilities hard PSS-04Error handling and Logging Mechanisms easy PSS-05Authentication Mechanisms moderate PSS-06Session Management moderate PSS-07Confidentiality of Authentication Information moderate PSS-08Roles and Rights Concept hard PSS-09Authorisation Mechanisms hard PSS-10Software Defined Networking easy PSS-11Images for Virtual Machines and Containers hard PSS-12Locations of Data Processing and Storage moderate

C5: Security Incident Management

SIM-01Policy for security incident management hard SIM-02Processing of security incidents moderate SIM-03Documentation and reporting of security incidents hard SIM-04Duty of the users to report security incidents to a central body hard SIM-05Evaluation and learning process hard

C5: Security Policies and Instructions

SP-01Documentation, communication and provision of policies and instructions moderate SP-02Review and Approval of Policies and Instructions hard SP-03Exceptions from Existing Policies and Instructions hard

C5: Control and Monitoring of Service Providers and Suppliers

SSO-01Policies and instructions for controlling and monitoring third parties moderate SSO-02Risk assessment of service providers and suppliers hard SSO-03Directory of service providers and suppliers moderate SSO-04Monitoring of compliance with requirements moderate SSO-05Exit strategy for the receipt of benefits hard