Cloud Computing Compliance Criteria Catalogue (C5:2026)

Objective: Identify the organisation’s own assets and ensure an appropriate level of protection throughout their lifecycle.

Objective: Plan, implement, maintain and test procedures and measures for business continuity and emergency management.

Objective: Avoid non-compliance with legal, regulatory, self-imposed or contractual information security and compliance requirements.

Objective: Ensure the protection of information in networks and the corresponding information processing systems.

Objective: Ensure appropriate and effective use of cryptography to protect the confidentiality, authenticity or integrity of information.

Objective: Ensure information security in the development cycle of cloud service system components.

The information on the general conditions of the cloud service - also called ‘General Conditions’ or ‘GC’ for short - serves to provide cloud service customers with additional information on the level of information security offered by the cloud service. The information enables cloud service customers to assess the suitability of the cloud service for their individual use case. They are also intended to ensure a comparable reporting to make it easier for cloud service customers to compare several cloud service providers or cloud services for which a C5 report has been issued.

Since in the case of a direct engagement, the audit is not based on a system description provided by the cloud service provider, the auditor shall document details of the general conditions in accordance with the information provided by the cloud service provider (cf. section 3.4).

The information is prepared to meet the common needs of a broad range of subject matter experts of the cloud service customers who define or implement information security requirements, validate their effectiveness or assess the suitability of the cloud service from a legal and regulatory perspective (e.g. IT, compliance, internal audit).

Objective: Ensure that personnel understands its responsibilities, is aware of its responsibilities regarding information security, and that the organisation’s assets are protected in the event of changes in responsibilities or termination.

Objective: Secure the authorisation and authentication of users of the cloud service provider to prevent unauthorised access.

Objective: Ensure appropriate handling of government investigation requests for legal review, information to cloud service customers, and limitation of access to or disclosure of data.

Objective: Plan, implement, maintain and continuously improve the information security framework within the organisation.

Objective: Ensure proper and regular operation, including appropriate measures for planning and monitoring capacity, protection against malware, logging and monitoring events, and dealing with vulnerabilities, malfunctions and failures.

Objective: Enable the ability to access the cloud service via other cloud services or IT systems of the cloud service customers, to obtain the stored data at the end of the contractual relationship and to securely delete it from the cloud service provider.

Objective: Prevent unauthorised physical access and protect against theft, damage, loss and outage of operations.

Objective: Provide up-to-date information on the secure configuration and known vulnerabilities of the cloud service for cloud service customers, appropriate mechanisms for troubleshooting and logging, as well as authentication and authorisation of users of cloud service customers.

Objective: Ensure a consistent and comprehensive approach to the capturing, evaluation, communication and handling of security incidents.

Objective: Provide policies and procedures regarding security requirements and to support business requirements.

Objective: Ensure the protection of information that service providers or suppliers of the cloud service provider (service organisation) can access and monitor the agreed services and security requirements.