BSI C5: what the criteria catalogue covers and who needs it

This page explains the framework: what C5 is, what the catalogue contains and who needs it. What a C5 attestation shows as evidence, which report type fits and how the C5 audit process works are each covered on a separate page.

What is BSI C5?

C5 is a criteria catalogue of the BSI against which an independent auditor assesses the information security of a cloud service. The name stands for Cloud Computing Compliance Criteria Catalogue; the German version is called “Kriterienkatalog Cloud Computing C5”. In its FAQ, the BSI describes it as an audit standard that sets minimum requirements for secure cloud computing.

C5 has existed since 2016. According to the catalogue, the current revision C5:2026 is the second substantive revision and builds on C5:2020 (section 1.1). It contains 168 criteria, compared with 121 in C5:2020. C5:2026 applies to type 1 reports with a specified date on or after 1 June 2027 and to type 2 periods beginning on or after that date; earlier use is permitted (section 3.5). What has changed and which special rules apply to periods spanning the cut-off date is covered on C5:2026.

According to the BSI FAQ, the catalogue is technology-neutral: it sets auditable criteria but does not prescribe specific products or measures. The provider decides how to meet a criterion; the auditor assesses whether the chosen controls are sufficient.

What does the criteria catalogue contain?

The catalogue has three parts that matter to providers in different ways: rules for the evidence, information on the general conditions of the service and the criteria themselves.

The criteria are divided into basic and additional criteria. The basic criteria describe the minimum level for information with a normal protection need and form the minimum scope of every audit. Additional criteria are aimed at customers with a higher protection need; the provider chooses which of them to include in the audit and justifies the selection in the system description (section 3.4.3).

Who works with C5?

Three parties work with C5: cloud service providers implement the criteria, auditors provide evidence of conformity, cloud service customers evaluate the report. The BSI recommends that providers and customers use the criteria (catalogue, section 3.1) and publishes the catalogue. It is not involved in the audit or the report.

C5 can be used in any industry. According to the BSI FAQ, it can also be applied to IT services that are not explicitly called “cloud” but come close to cloud services. An audit always covers a cloud service in specified regions, never a company as a whole.

Who needs C5 and when is it mandatory?

A provider needs C5 evidence when customers ask for it or when a regulation requires it for the provider’s customers. The catalogue itself is not a law: in its FAQ, the BSI describes it as generally a recommendation. It becomes binding through other rules and through contracts.

• Customers in procurement. The catalogue advises cloud service customers to make compliance with the criteria part of engaging a provider and to agree it in the contract, in particular where additional criteria are to be met (section 3.1). For providers this means the requirement can arrive through tenders, supplier questionnaires or draft contracts.
• Federal bodies. Cloud customers in the German federal administration are subject to the BSI minimum standard for the use of external cloud services (Mindeststandard des BSI zur Nutzung externer Cloud-Dienste). According to the BSI FAQ, federal bodies must therefore request evidence from the provider that the C5 criteria are met. What this means for providers is covered on C5 for public administration.
• Healthcare. Section 393 SGB V (Book V of the German Social Code) allows healthcare providers, statutory health and long-term care insurers and their processors to process social and health data using a cloud computing service under conditions that include a current C5 attestation for the basic criteria. Under certain conditions the provision also accepts equivalent evidence (C5 Equivalence Ordinance (C5GleichwV)). Details and deadlines are on Section 393 SGB V. Whether and how the provision applies to a specific service needs a legal assessment in each case; for its interpretation, the BSI refers to the Federal Ministry of Health.
• AI services. The BSI catalogue AIC4 for cloud services using machine learning is designed as an extension of C5. The BSI names C5 as a prerequisite but also considers the AIC4 criteria combinable with comparable catalogues. Applying AIC4 is voluntary. For AI systems, the BSI has also published A5, criteria and an audit methodology as a community draft; its cloud module requires a C5 attestation of the underlying infrastructure.
• Sovereignty. Whether a cloud service can be used in a self-determined way is assessed by the BSI catalogue C3A. It assumes that the provider meets C5 and is not binding in itself.
• NIS2 and the financial sector. Neither the German BSI Act as amended to implement NIS2 nor the DORA Regulation mentions C5; an attestation alone does not cover the obligations arising from them, see C5 and NIS2 and C5 and DORA.

Our assessment: whether a provider needs C5 follows from its customers’ requirements and from the regulations that apply to those customers. The first question is therefore: which customer requires which report for which service by when? Report type, audit scope and timeline follow from the answer.

How does a provider demonstrate C5 compliance?

The evidence is an attestation: the report of an independent auditor who has tested the provider’s controls against the applicable C5 criteria. The catalogue requires a reasonable assurance engagement under ISAE 3000 (Revised) or an equivalent such as IDW PS 860 (sections 3.2 and 3.4.1). There is no certificate and no official logo; what is meant when a tender asks for a “C5 certificate” is explained on C5 attestation.

• What the report contains and how customers read it: C5 attestation.
• Type 1 assesses the design of the controls as of a specified date, type 2 also their operating effectiveness over a period: C5 type 1 or type 2.
• How the audit runs from engagement to report: C5 audit process.
• Which services and subservice organisations belong in the audit scope: C5 scope.
• According to the BSI FAQ, an ISO 27001 certificate does not automatically lead to a C5 attestation. In the basic criteria, C5 requires an information security management system that complies with ISO/IEC 27001, but no certificate (OIS-01.01B). What you can reuse: C5 and ISO 27001.

C5 is an information security standard. According to the BSI FAQ, it does not cover data protection; requirements under the GDPR remain a separate task.

Blackfort Technology does not issue attestations. An independent auditor issues the attestation; we prepare providers up to audit readiness.

Example: does this provider need C5?

Fictitious example, not a client. A software company with 40 employees runs a document management system for public authorities as SaaS on a hyperscaler platform. It holds an ISO 27001 certificate. A federal authority asks for a “C5 certificate” for the service in a tender.

1. Is it a cloud service? The software runs at the provider and is used over the network, so a C5 audit of the service is an option.
2. Where does the requirement come from? The authority is a federal body. It is subject to the BSI minimum standard for the use of external cloud services, under which it requests C5 evidence from the provider. Which criteria and which report type it expects, the provider learns from the tender documents.
3. What exactly is needed? A C5 attestation; there is no certificate. Report type, basic or also additional criteria, the audited service and the deadline need to be clarified.
4. What does the ISO certificate bring? It shows an existing ISMS. Which C5 criteria it already covers only becomes clear in a comparison.

The next step would be to set the scope to this one service and measure the distance to the basic criteria in a C5 readiness assessment, criterion by criterion.