C5 (Germany)
C5: Security Policies and Instructions

C5 (Germany) C5-SP-03: Exceptions from Existing Policies and Instructions

Route every deviation from security policies, instructions and the related controls through the risk management process, secure risk owner approval and residual risk acceptance, record each deviation with a defined expiry, and have risk owners reconfirm its appropriateness at least annually.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 27 controls across 17 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

FedRAMP Moderate · 4 controls

  • CA-5 Plan of Action and Milestones
  • CM-6 Configuration Settings
  • PL-11 Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions
  • RA-7 Risk Response

FedRAMP High · 3 controls

  • CA-5 Plan of Action and Milestones
  • CM-6 Configuration Settings
  • PL-11 Baseline Tailoring. Tailor the selected control baseline by applying specified tailoring actions

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

NIS2 Directive · 2 controls

  • Art.21.2.a Policies on risk analysis and on information system security
  • Art.21.4 Take corrective measures without undue delay on finding that the measures are not met

NIST SP 800-161 Rev 1 · 2 controls

NIST SP 800-171 Rev 3 · 2 controls

NIST SP 800-53 Rev 5 · 2 controls

APRA CPS 234 · 1 control

  • CPS234-28 Escalation of Unremediated Testing Deficiencies

Azure Security Benchmark · 1 control

  • AM-2 Use only approved services

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies

DORA · 1 control

ISO 27001:2022 · 1 control

  • 5.36 Compliance with policies, rules and standards for information security

ISO 27002:2022 · 1 control

  • 5.36 Compliance with policies, rules and standards for information security

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked

NIST SP 800-218 · 1 control

PCI DSS 4.0 · 1 control

  • 2.2.5 2.2.5 Insecure services, protocols or daemons secured

SOC 2 · 1 control

  • SOC2-CC5.3 CC5.3 Deploying controls through policies and procedures (COSO principle 12)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in C5: Security Policies and Instructions

You are reading one control. How much of C5 (Germany) have you already done?

C5 (Germany) C5-SP-03 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of C5 (Germany) your existing evidence covers. Hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 and 95 of 121 C5 (Germany) controls already carry evidence.

If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.178.5% covered · 26 gapsIf you hold NIST SP 800-53 Rev 572.7% covered · 33 gapsIf you hold FedRAMP Moderate71.1% covered · 35 gapsIf you hold ISO 27002:202267.8% covered · 39 gapsIf you hold ISO 27001:202257% covered · 52 gapsIf you hold NIST SP 800-171 Rev 350.4% covered · 60 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 27 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll C5 (Germany) controls