BSI C5: Cloud Security Attestation for the German Market

BSI C5, the Cloud Computing Compliance Criteria Catalogue, is the German Federal Office for Information Security's standard for the minimum security of cloud services. First published in 2016, it has become the reference for cloud security in Germany: federal agencies expect it, German law requires it for cloud processing of health data, and many German enterprises and public bodies ask for a C5 report before buying a cloud or SaaS service.

C5 works through attestation. An independent auditor tests the provider against the criteria and issues a report, similar to a SOC 2 report, that customers can review. In 2026 the BSI published a revised catalogue, C5:2026, which expands the criteria and aligns them with the planned European cloud certification scheme. This guide explains what C5 covers, how attestation works, what C5:2026 changes, who requires it and how to prepare.

What is BSI C5?

C5 defines a baseline of security requirements for cloud service providers, together with transparency requirements that help customers understand where and how their data is processed. It is aimed at three groups: cloud service providers, who implement the criteria; auditors, who assess them; and customers, who use the audit report to make risk decisions. The BSI states that customers share responsibility for security and should obtain and analyse their provider's C5 report each year.

According to the BSI, more than a hundred attestations have been issued to national, European and global cloud providers, and small and medium providers also use the catalogue.

History and versions

The BSI introduced C5 in 2016 to give German organisations a common, auditable baseline for cloud security, at a time when cloud adoption in the public sector and regulated industries was growing but trust was limited. The 2020 revision, C5:2020, updated the criteria to reflect technology and threat changes, added a domain on product safety and security, and strengthened transparency on government data requests. C5:2026, published in 2026, is the next major revision. Each version is used for a transition period, so providers should check which version their current and next audit cycles must follow.

Who requires C5?

• German federal administration, whose cloud policies expect C5 attestation for external cloud services.
• Healthcare: Section 393 of the German Social Code Book V, introduced by the 2024 Digital Act, requires that cloud services used by healthcare providers and statutory health insurers to process health and social data have a current C5 attestation.
• Financial services and critical infrastructure, where regulators and operators use C5 to assess outsourcing to the cloud.
• German enterprises that include C5 in vendor security requirements.

Is it mandatory or voluntary?

C5 is voluntary as a standard, but mandatory in practice for the uses above and legally required for certain healthcare cloud processing. It is an attestation, not a certification: there is no certificate, but an audit report that customers rely on.

Structure of the criteria

C5:2020 contains 121 criteria organised in 17 domains, including organisation of information security, security policies, personnel, asset management, physical security, operations, identity and access management, cryptography and key management, communication security, portability and interoperability, procurement and development of systems, control of service providers and suppliers, incident management, business continuity, compliance, dealing with investigation requests from government agencies, and product safety and security. Criteria are of several types:

• Basic criteria: the minimum requirements every attested provider must meet.
• Additional criteria: stricter requirements for higher protection needs, which providers can choose to include.
• Complementary customer criteria: controls the customer must implement for the overall system to be secure, such as managing its own users.
• Environment parameters: transparency information on data location, jurisdiction, certifications held, and handling of government investigation requests.

Key areas in more detail

• Identity and access management: role-based access, MFA for privileged and remote access, regular reviews, and strict control of administrator accounts at the provider.
• Cryptography and key management: encryption in transit and at rest, documented key lifecycles, and, increasingly, options for customers to control their own keys.
• Operations: capacity management, malware protection, backups, logging and monitoring, vulnerability and patch management, and segregation of customer environments.
• Development and procurement: secure development, testing, change management and handling of third-party components.
• Incident management: detection, response and timely customer notification.
• Business continuity: plans, redundancy and tested recovery.
• Investigation requests: how the provider handles requests from government agencies for customer data, including legal review and customer notification where permitted.
• Product safety and security: secure configuration guidance, vulnerability handling and information for customers about their responsibilities.

Building on hyperscaler attestations

Most SaaS companies run on a large cloud platform. Major hyperscalers hold C5 attestations for many of their services, and a SaaS provider's auditor can rely on them for the infrastructure layer. In the report, the hyperscaler is treated as a subservice organisation, and the SaaS provider must show it has reviewed the hyperscaler's report and implemented any complementary controls it requires, such as configuring encryption, access and logging correctly. The SaaS provider remains responsible for its own application, operations and people. Choosing services that are covered by the hyperscaler's C5 report, and documenting this, simplifies the audit.

Attestation: Type 1 and Type 2

C5 audits are performed by independent auditors, typically under the international assurance standard ISAE 3000 (Revised). There are two report types:

Type	What it shows
Type 1	The design and implementation of controls at a point in time.
Type 2	The design and operating effectiveness of controls over a period, usually 6 to 12 months.

Type 2 provides much stronger assurance and is usually expected after a first Type 1, because it shows that controls actually worked throughout the period rather than only on the day they were examined. Reports include the provider's system description, the auditor's testing and results, and any deviations. Many providers combine C5 with SOC 2 or ISO/IEC 27001 audits to reuse evidence.

C5:2026

The BSI published C5:2026 in spring 2026, describing the catalogue as completely revised to reflect the latest developments. According to published analyses:

• The number of criteria rises from 121 to 168, still divided into basic criteria and additional criteria.
• The structure is based on the planned European Cybersecurity Certification Scheme for Cloud Services (EUCS), with compatibility to the CSA Cloud Controls Matrix, ISO/IEC 27001 and NIS2.
• Key management is greatly expanded, from 2 to 14 controls.
• New requirements cover areas such as confidential computing, container management, patch management, home office risks and post-quantum cryptography.
• Requirements for transparency about subservice organisations, such as data centres, are stronger.
• Audit reports must describe in more detail how each requirement was met and how deviations were handled.

Commentators report that C5:2026 becomes binding for assessment periods from June 2027, with earlier adoption permitted. Check the BSI's C5:2026 publication for the official transition rules before planning an audit cycle. The BSI has also published C3A, a set of cloud sovereignty criteria that builds on C5:2026.

What customers should do with a C5 report

The BSI is clear that a C5 report does not transfer all responsibility to the provider. Customers should request the report, read the system description and the auditor's findings, check whether any deviations affect their use, review the environment parameters such as data location and jurisdiction against their own legal requirements, and implement the complementary customer criteria the provider lists. Because reports cover a defined period, customers should obtain the current report each year. The BSI does not select auditors or review reports itself, so this customer analysis is an essential part of the model. For SaaS providers, making reports easy to obtain under non-disclosure terms and explaining customer responsibilities clearly speeds up sales.

C5 and the European cloud certification scheme

The EU has been developing a European Cybersecurity Certification Scheme for Cloud Services (EUCS) under the Cybersecurity Act, but it has taken years to agree, partly because of debates about sovereignty requirements. C5:2026 was designed using the EUCS requirements as a basis, so providers that align with C5:2026 should be well placed if EUCS is adopted. Until then, C5 remains the most established cloud attestation in Germany, and other national schemes exist in some EU countries.

Benefits and limitations

• Benefits: recognised by German public and private buyers, required for some healthcare uses, transparent about data location and government access, and reusable across many customers.
• Limitations: an attestation rather than a certificate, focused on the German market, requires annual audits for Type 2 assurance, and the 2026 revision adds significant new work.

How to prepare, step by step

1. Confirm customer requirements: which C5 version, Type 1 or Type 2, and any additional criteria.
2. Define the scope: services, locations, and subservice organisations such as hosting providers.
3. Gap-assess against the C5 criteria, mapping existing ISO/IEC 27001 or SOC 2 controls.
4. Close gaps, especially in key management, logging, supplier control and government request handling.
5. Write the system description, including environment parameters and complementary customer criteria.
6. Select an auditor experienced in C5.
7. Run a Type 1 audit, then a Type 2 over the following period.
8. Repeat annually and plan the move to C5:2026.

Documentation you will need

• System description and scope.
• Policies and procedures for each C5 domain.
• Environment parameter disclosures, including data location and jurisdiction.
• List of subservice organisations and their attestations.
• Complementary customer criteria for customers.
• Evidence of control operation over the audit period.
• Prior audit reports and remediation records.

Timeline and cost considerations

A provider with ISO/IEC 27001 and SOC 2 can often prepare for a first C5 Type 1 in three to six months, and complete a Type 2 period of six to twelve months after that. Costs include auditor fees, which depend on scope and report type, internal effort for documentation and controls, and any technical changes such as key management or EU hosting.

Common mistakes

• Treating C5 as identical to ISO 27001, missing transparency and cloud-specific criteria.
• Weak environment parameter disclosures, such as vague data location statements.
• Ignoring subservice organisations or lacking their reports.
• Unclear complementary customer criteria, leaving customers unsure what they must do.
• Not planning for C5:2026 and its expanded key management requirements.

Best practices, tools and technologies

• Host German and EU customer data in EU regions and document the locations precisely.
• Use a key management service with customer-managed keys where possible.
• Centralise logging and monitoring with retention matching audit periods.
• Maintain a supplier register with C5, SOC 2 or ISO reports for each subservice organisation.
• Write a clear process for handling government data requests.
• Use a single control framework mapped to C5, ISO/IEC 27001 and SOC 2.

We build and run SaaS platforms with EU hosting, key management, logging and documented customer responsibilities through our SaaS product and migration services.

How C5 relates to other frameworks

Framework	Relationship
ISO/IEC 27001	Management system certification; C5 adds cloud-specific and transparency criteria.
ISO/IEC 27017	Cloud security controls guidance mapped into C5.
CSA STAR	Cloud Controls Matrix that C5:2026 is designed to be compatible with.
SOC 2	Similar attestation model; often audited together with C5.
GDPR	Data protection law; C5 environment parameters help customers assess transfers.

Real-world example

A SaaS company offering patient scheduling software, built by an Indian engineering team, wants to sell to German hospitals. Because hospitals process health data in its cloud service, Section 393 SGB V requires a current C5 attestation. The company already holds ISO/IEC 27001 and SOC 2 Type 2, hosts in a Frankfurt region, and maps its controls to C5. It adds customer-managed encryption keys, a documented process for government data requests, and complementary customer criteria for hospital administrators. It completes a C5 Type 1, then a Type 2 over nine months, and plans its next cycle against C5:2026.

Next steps

1. Confirm what your German customers require.
2. Map existing controls to C5.
3. Close cloud-specific and transparency gaps.
4. Run Type 1, then Type 2.
5. Plan for C5:2026.

Frequently asked questions

What is BSI C5?

The German Federal Office for Information Security's catalogue of minimum security and transparency requirements for cloud services.

Is C5 a certification?

No. It is an attestation: an independent auditor issues a report on whether criteria are met.

What is the difference between C5 Type 1 and Type 2?

Type 1 covers control design at a point in time; Type 2 covers design and operating effectiveness over a period.

Is C5 mandatory?

It is required for German federal cloud use and by law for cloud processing of health data in the German healthcare system, and often by enterprise buyers.

What is new in C5:2026?

More criteria (168 instead of 121), alignment with EUCS, expanded key management, and requirements for confidential computing, containers and post-quantum cryptography.

When does C5:2026 apply?

Published analyses report it becomes binding for assessment periods from June 2027; check the BSI's transition guidance.

Can non-German providers get a C5 attestation?

Yes. Many global providers hold C5 attestations.

How does C5 compare with SOC 2?

Both are attestation reports; C5 has its own criteria and stronger transparency on data location and jurisdiction.

What are environment parameters?

Disclosures on data location, jurisdiction, certifications and handling of government investigation requests.

What are complementary customer criteria?

Controls the customer must implement for the overall service to be secure, such as managing its own users and configuring security settings.

Can a SaaS provider rely on its cloud provider's C5 report?

For the infrastructure layer, yes, as a subservice organisation, but it must still cover its own application, operations and complementary controls.

How often must a C5 audit be repeated?

Customers usually expect a current report each year, so providers typically run annual Type 2 audits.

Does C5 cover data protection law?

Not directly. It supports GDPR assessments through transparency on data location and security, but GDPR compliance needs separate analysis.