SSO-04 Monitoring of compliance with requirements
Verify that third parties meet agreed security and legal obligations by reviewing service quality reports, management system certificates, independent assurance reports and their vulnerability and incident records, at a cadence set by risk class, feeding results into reassessment and treatment.
Source: BSI C5 (121-criteria catalogue), SSO-04. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open BSI C5 (121-criteria catalogue) in the compliance library.
The edition of the catalogue is not stamped here; check the edition your attestation is issued against.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Register of assurance reports and certificates received from suppliers with expiry dates · Vendor register / contract repository
- Correspondence obtaining a supplier's vulnerability and incident handling records · Vulnerability scanner / patch tooling
periodic reviewEvidence produced at each review
- Review notes evidencing evaluation of a supplier's service quality reporting · Vendor register / contract repository
governing documentDocuments that govern the control
- Mapping of monitoring frequency to each supplier's assigned risk class · Policy repository / GRC workspace
First move
Common gaps auditors find
- Certificates collected and filed but never read or evaluated
- Monitoring performed at a uniform cadence irrespective of supplier criticality
- Qualifications and exceptions in a supplier assurance report not carried into the provider's own risk treatment
- Monitoring outcomes never used to refresh the supplier risk rating
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetSSO-03 Directory of service providers and suppliers · SSO-05 Exit strategy for the receipt of benefits