Consulting on BSI C5
BSI C5 consulting: ready for your C5 attestation
We take cloud and SaaS providers from scoping to audit readiness for a C5 attestation under the C5:2026 catalogue. Your ISO 27001 and SOC 2 work is reused, and the plan starts from your customer or audit deadline. The attestation itself is issued by an independent auditor.
What BSI C5 asks of a cloud service
C5 is the criteria catalogue of the German Federal Office for Information Security (BSI) for the information security of cloud services. The current revision, C5:2026, contains 168 criteria and applies to Type 1 reports with a specified date on or after 1 June 2027 and to Type 2 periods beginning on or after that date; earlier adoption is permitted. Compliance is shown by an attestation, not a certificate: an independent auditor assesses whether the controls of your service meet the applicable criteria, under ISAE 3000 (Revised) or the German IDW PS 860. The BSI takes no part in the audit or the report.
Much of an ISO 27001 certificate or a SOC 2 report can be reused, but neither is enough for the attestation on its own. C5 goes into detail on cloud-specific topics such as tenant separation, containers, oversight of service organisations and data location, and the auditor usually bases the audit on the provider’s system description, written to the catalogue’s requirements. For international providers entering the German healthcare market, Section 393 SGB V (Book V of the German Social Code) can be the reason to look at C5. Whether and how it applies to your service needs a legal assessment in each case.
How we help
Pick the modules you need. We recommend starting with a gap analysis.
Where do we stand?
C5 gap analysis
Scope, existing evidence and the route to the report type you need. You get a rating per criterion, a prioritised action plan and a timeline planned back from your deadline.
C5 readiness assessmentWhat is in scope?
Scope and platform
One service or several, which regions, which additional criteria. If your service runs on someone else’s platform, we decide with you whether the platform is excluded from your audit (carve-out method) or included in it (inclusive method).
More on C5 scopeWhen do you need the report?
Report type and schedule
Type 1 as of a specified date or straight to Type 2 over a period. We plan back from your customer’s deadline: when the audit period can start and what has to be in place before it.
C5 Type 1 or Type 2ISO 27001 in place?
Reuse your ISMS
We map ISMS documentation and the statement of applicability to the C5 criteria and close the gaps where C5 goes beyond ISO 27001.
C5 and ISO 27001SOC 2 report in place?
Extend SOC 2
A SOC 2 system description may be reused but has to be adapted to the C5 requirements. We extend description and controls and align the timing of both audits.
C5 and SOC 2Controls missing?
Implementation support
Policies, processes and technical controls, for example for privileged access, logging, containers, key management and continuity testing. We work with your operations and engineering teams and train them where needed.
What will the auditor read?
System description
We write the description with you following the eight minimum content items in section 3.4.5.1, including general conditions, subservice organisations and the complementary user entity controls (CUEC), that is, the controls your service relies on customers to perform.
C5 system descriptionCustomers in German healthcare?
Section 393 SGB V
We align the scope with the basic criteria named in Section 393 SGB V. If you take the route via the C5 Equivalence Ordinance (C5GleichwV), we prepare the technical action plan with you. Whether this route is legally open for your service is for your legal counsel to decide.
Section 393 SGB VAudit coming up?
Auditor and audit
We help you compare auditor proposals, prepare evidence for the audit period and support you through auditor questions and deviations up to the report.
C5 audit processWhat is in place after implementation
What is produced after the gap analysis, during implementation and preparation. Your team can keep working with these documents after the project; templates for several of them are free to download.
01
Implemented controls
Policies, processes and technical controls for the gaps found in the gap analysis, with owners and evidence.
02
Evidence register
Which evidence supports which control, where it is kept and whether it covers a specified date or the whole audit period.
03
CUEC responsibility matrix
Which controls your service relies on customers to perform, with owners on both sides.
04
Subservice inventory
Subservice organisations, method, location of processing, available reports and monitoring.
05
System description for the audit
A draft based on section 3.4.5.1 as the basis for your management statement and the audit.
06
Internal readiness review
Open points before the audit period starts and the documents you need to request auditor proposals.
Common starting points
Where providers come from when they need a C5 attestation, what the catalogue says and what we would do next.
| Starting point | What the catalogue says | Next step |
|---|---|---|
| ISO 27001 certificate | OIS-01 requires an ISO/IEC 27001-compliant ISMS, but results from ISO certification audits are to be assessed differently from an ISAE 3000 audit. | Gap analysis mapping your ISO documentation to the C5 criteria |
| SOC 2 report | An existing description may be reused but has to be adapted to the C5 description criteria. The catalogue recommends aligning SOC 2 and C5 audits. | Extend description and controls to C5, align audit periods |
| Service runs on a public cloud platform | Software on another provider’s infrastructure is generally a subservice relationship. Carve-out does not remove accountability. | Choose the method, review the platform’s C5 report, document monitoring |
| Customer needs a Type 2 report by a date | A Type 1 report is not required before Type 2. The Type 2 period should cover three to twelve months. | Plan backwards: start of the period, implementation before it |
| Customers in German healthcare | Section 393 SGB V names an up-to-date C5 attestation for the basic criteria as one condition. The BSI does not interpret Section 393 and refers questions to the Federal Ministry of Health. | Align scope to the basic criteria, get a separate legal assessment |
Summary of our own assessment based on BSI C5:2026 (sections 3.3, 3.4.4, 3.4.6, 3.4.11, OIS-01), the BSI C5 FAQ and Section 393 SGB V, as of 1 November 2026. Not legal advice.
Our approach
Five steps from the first call to the report. We support the first four; the auditor performs the fifth.
1
Initial call
Service, trigger, deadline and existing documents. Without obligation.
2
Gap analysis
Rating per criterion, action plan and a timeline planned back from the deadline.
3
Implementation
Introduce controls, build up evidence, write the system description.
4
Audit readiness
We review evidence and description against the criteria before the audit period starts.
5
Audit
The independent auditor performs the audit and issues the report. We support you with questions.
How long it takes depends on scope, starting point and report type. For Type 2, the audit period should cover at least three and no more than twelve months. Our recommendation: have the controls operating when the period starts, otherwise there is no evidence of operating effectiveness for the first weeks; for a first engagement, section 3.4.11 allows alternative evidence. The gap analysis gives you a plan for your case.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
Example: the full path for a telemedicine platform
A fictitious example, not a client: a provider of a platform for video consultations and appointment booking runs its service with a data centre operator in Germany. Because it also sells to international customers, it holds a SOC 2 Type 2 report. A large group of medical practices makes a C5 Type 2 report a condition of a new framework contract. In the initial call we go through the service, the deadline and the existing documents.
Gap analysis: the scope covers the platform in the German region, without internal tools. The data centre operator is treated as a subservice organisation under the carve-out method. The SOC 2 description is the starting point; among other things, it lacks the information on the general conditions of the service (GC-01 to GC-06). Which catalogue revision applies depends on when the Type 2 period starts. What a gap analysis result looks like is shown in the sample result on the C5 readiness assessment page.
Implementation: the provider’s team introduces the missing controls with us, for example structured key management and an annual review of the data centre’s C5 report. Evidence register, subservice inventory and responsibility matrix are built alongside. The practices manage their staff’s access themselves; this goes into the system description as a complementary user entity control (CUEC).
Readiness review and audit: before the audit period starts, we check evidence and system description against the criteria, and the provider closes the open points. The provider selects and engages the auditor and aligns the timing of the SOC 2 and C5 audits, as the catalogue recommends. During the period we support the provider with auditor questions; the opinion is the auditor’s.
Who C5-Readiness is for
Cloud and SaaS providers who need a C5 attestation and have a fixed customer or audit date. We particularly address providers of AI software for healthcare and providers that already have ISO 27001 or SOC 2 structures to build on, including international providers entering the German market. We work in English and German.
What we do not do
Consulting and auditing stay separate.
- We do not issue attestations. The report comes from an independent auditor; Blackfort Technology has no partnership with any audit firm.
- We do not promise an attestation or a report without deviations. The opinion is the auditor’s.
- Your management signs the management statement and needs its own basis for it. The audit does not replace your own monitoring.
- We do not give legal advice. On Section 393 SGB V, the C5 Equivalence Ordinance (C5GleichwV), NIS2 or DORA we provide general information only.
A C5 attestation covers the information security of a cloud service. It does not by itself satisfy data protection law or obligations such as NIS2 or DORA.
Frequently asked questions
What happens in the initial call?+
The initial call takes place by phone or video, as you prefer. We talk about your service, the trigger, the deadline and the documents you already have. Afterwards you know whether a gap analysis makes sense and what scope fits your service. If you wish, you then receive a written proposal. The call does not commit you to anything.
What do you need from us beforehand?+
A short description of the service, the trigger (for example a customer requirement, a tender or Section 393 SGB V) and the date by which a report is needed. Details of an ISO 27001 certificate or SOC 2 report help if you have them. We do not need confidential documents or access to your systems for the initial call.
Do you work in English?+
Yes. Calls, workshops and work products such as the action plan or the system description are available in English or German, depending on what your team and your auditor need.
Why do you not audit yourselves?+
Whoever helped build a system should not audit it. We prepare you, and the attestation is issued by an independent auditor whom you select and engage yourself. We have no partnership with any audit firm.
Do you work remotely or on site?+
Both. Document reviews, interviews and coordination work well by video call. On-site days, for example for workshops with operations and engineering, are agreed when the project needs them and set out in the proposal.
What does it cost?+
We do not publish prices on this website, because the effort depends on scope, starting point and report type. After the initial call you receive a proposal with a fixed scope. The auditor’s fee is agreed directly with the auditor.
Read more
- C5 readiness assessment: gap analysis, action plan and timeline
- C5 attestation vs C5 certification: report and meaning
- C5 Type 2 or Type 1 report: differences, period, choice
- C5 scope: service boundary, platform reports, carve-out
- C5 vs ISO 27001: what you can reuse and what is missing
- C5 vs SOC 2: reusing your SOC 2 report for a BSI C5 attestation
- C5 system description: minimum content, structure and example
- BSI C5 audit process: steps, audit standards and timeline
- Section 393 SGB V: C5 attestation for healthcare cloud services
- Free C5 templates: scope sheet, evidence register, CUEC matrix
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (PDF), licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: C5 FAQ (German) (retrieved 2026-11-01)
- Section 393 SGB V (German) (retrieved 2026-11-01)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-01
Get in touch
Talk to us about your C5 project
Tell us which service needs to be audited and by when a report is due. We usually reply within 1-2 working days. In an initial call, by phone or video as you prefer, we work out where you stand and what the path looks like.