| No. | Area | Objective |
| 1 | Organisation of information security (OIS) 5.1 on page 37 | Planning, implementation, maintenance and continuous improvement of an information security framework within the organisation |
| 2 | Security policies and work instructions (SP) 5.2 on page 42 | Provide guidelines and instructions regarding the security claim and to support business requirements |
| 3 | Human Resources (HR) 5.3 on page 45 | Ensure that employees understand their roles, are aware of their responsibilities in relation to information security and that the organisation's assets are protected when roles change or are terminated |
| 4 | Asset Management (AM) 5.4 on page 49 | Identify the organisation's assets and ensure an appropriate level of protection throughout their lifecycle |
| 5 | Physical security (PS) 5.5 on page 54 | Prevent unauthorised physical access and protect against theft, damage, loss and operational failure |
| 6 | Regular operation (OPS) 5.6 on page 61 | Ensuring proper regular operation, including appropriate measures for planning and monitoring capacity, protection against malware, logging and monitoring of events and dealing with vulnerabilities, faults and errors |
| 7 | Identity and authorisation management (IDM) 5.7 on page 77 | Securing the authorisation and authentication of users of the cloud provider (usually privileged users) to prevent unauthorised access |
| 8 | Cryptography and key management (CRY) 5.8 on page 84 | Ensuring appropriate and effective use of cryptography to protect the confidentiality, authenticity or integrity of information |
| 9 | Communication security (COS) 5.9 on page 87 | Ensuring the protection of information in networks and the corresponding information processing systems |
| 10 | Portability and interoperability (PI) 5.10 on page 92 | Enabling the ability to access the cloud service via other cloud services or cloud customers' IT systems, to retrieve the stored data upon termination of the contractual relationship and to securely delete it from the cloud provider |
| 11 | Procurement, development and modification of information systems (DEV) 5.11 on page 95 | Ensuring information security in the development cycle of system components of the cloud service |
| 12 | Control and monitoring of service providers and suppliers (SSO) 5.12 on page 101 | Ensuring the protection of information that service providers or suppliers of the cloud provider (sub-service providers) can access and monitoring the agreed services and security requirements |
| 13 | Dealing with security incidents (SIM) 5.13 on page 106 | Ensuring a consistent and comprehensive procedure for recording, evaluating, communicating and handling security incidents |
| 14 | Business continuity and incident management (BCM) 5.14 on page 110 | Plan, implement, maintain and test procedures and measures for business continuity and emergency management |
| 15 | Compliance (COM) 5.15 on page 113 | Avoiding violations of legal, regulatory, self-imposed or contractual information security requirements and verifying compliance |
| 16 | Dealing with enquiries from government agencies (INQ) 5.16 on page 116 | Ensure appropriate handling of government investigation requests with regard to legal review, informing cloud customers and limiting access to or disclosure of data |
| 17 | Product security (PSS) 5.17 on page 118 | Providing cloud customers with up-to-date information on the secure configuration and known vulnerabilities of the cloud service, suitable mechanisms for error handling and logging as well as for authentication and authorisation of cloud customer users |
