BSI C5:2026: what is new and which revision your audit needs

This page shows what C5:2026 changes compared with C5:2020, which revision applies to your next audit and how the move works. What C5 is in general is explained on BSI C5; choosing between type 1 and type 2 on C5 type 1 or type 2.

What is C5:2026 and which version is current?

C5:2026 is the current revision of the BSI’s Cloud Computing Compliance Criteria Catalogue. By its own account it is the second substantive revision and builds on C5:2020 (section 1.1). In substance it draws on the work on the European certification scheme EUCS and is meant to be compatible with its “Substantial” level; C5:2020 was the basis for that level.

There are two dates: the BSI website gives the end of March 2026 for the final version, the document itself gives 7 April 2026 as the first publication. Since then both language versions have been developed further, to different extents:

The language versions differ in one ID: the English complementing additional subcriterion AM-01.02AC (current asset inventory) appears in the German version as AM-02.01AC. All other 622 subcriterion IDs are identical. If you document in both languages, cite both IDs at this point.

What is new in C5:2026?

C5:2026 has more criteria, more finely divided subcriteria and new technical focus areas. The catalogue is divided into 17 domains and the general conditions GC-01 to GC-06; how criteria and subcriteria are structured and which domains exist is shown on Structure of the C5 criteria catalogue. What the information on the general conditions has to contain is shown on General conditions.

A dash means there is no information on this for C5:2020. As further changes, the catalogue states that it defines more precisely which types of data individual criteria apply to, and that the subcriteria, following the EUCS model, are clearly delineated from one another in content (section 1.1).

The catalogue itself names the new focus areas: container management, supply chain, post-quantum cryptography and confidential computing, plus more detailed treatment of multi-tenancy and technical sovereignty. Mapping them to criterion IDs in the following list is our assessment, based on title and wording:

• Containers: OPS-34 (policies for the entire container life cycle) and OPS-35 (implementation), both new.
• Supply chain: SSO-07 (transparency about service providers and their subcontractors), SSO-08 (exchange with suppliers of functional components), DEV-13 (list of software components, which can also be met with an SBOM, a software bill of materials), DEV-14 (third-party hardware and software) and OPS-29 (updates for third-party and open source libraries), all new. For SSO-07 a subservice inventory helps, bringing together service providers, subcontractors and their reports.
• Post-quantum cryptography: a PQC strategy as the complementing additional subcriteria CRY-01.01AC to CRY-01.03AC; in the basic criteria, crypto agility (CRY-01.01B) and cryptographic change management (CRY-02, new), see CRY domain.
• Confidential computing: OPS-32 and OPS-33 (remote attestation), both new; they apply only if the service offers confidential computing.
• Tenant separation: OPS-30 (separation based on a documented layer model, new), OPS-31 (implementation, successor to OPS-24) and COS-06 (separation of data traffic).
• Sovereignty: PSS-12 (region of processing and storage), which the catalogue calls a prerequisite for technical sovereignty, plus CRY-18 and CRY-19 on external key management and customer-managed keys (both new). PSS-12 does not require offering several regions. The BSI has published further sovereignty criteria in C3A.

What changes in the criterion IDs?

According to the BSI change history, each of the 121 criteria from C5:2020 is mapped to a criterion in C5:2026. 39 criteria are new without a predecessor, 51 have a new number. Examples: OIS-06 becomes OIS-07, IDM-01 becomes IAM-01, OPS-24 becomes OPS-31; CRY-04 was split into ten criteria. For 34 criteria an additional criterion was newly added, for 11 the basic criterion stayed unchanged.

The 39 new criteria according to the change history: OIS-05, OIS-09, OIS-10, HR-07, HR-08, AM-01, AM-03, AM-04, AM-10, AM-11, AM-12, PS-08, OPS-19, OPS-20, OPS-21, OPS-27, OPS-28, OPS-29, OPS-30, OPS-32, OPS-33, OPS-34, OPS-35, CRY-02, CRY-03, CRY-11, CRY-16, CRY-18, CRY-19, DEV-05, DEV-11, DEV-13, DEV-14, DEV-15, SSO-03, SSO-07, SSO-08, SIM-02, INQ-04.

For your documentation this means: references to old IDs in policies, control descriptions and evidence registers have to be updated. The change history refers to version 1.0.0; check individual cases against the version you are audited against.

Which revision applies to my audit?

For type 1 the specified date counts, for type 2 the start of the audit period, not the date of the report. The catalogue sets out the transition period and its special cases in section 3.5:

• C5:2026 applies to type 1 reports with a specified date on or after 1 June 2027 and to type 2 periods beginning on or after 1 June 2027. Earlier use is permitted.
• If a type 2 period begins before 1 June 2027 and ends after that date, the audit should cover only the C5:2020 criteria.
• The two revisions should not be combined in the same audit.
• If the audit period ends on or after 28 February 2027, the system description must also contain information on planned changes to the controls. The catalogue sets no end date for this obligation.

The following table applies these rules to typical cases. Column three reflects the catalogue, column four also the differing reading in the BSI FAQ.

On the difference: the BSI FAQ limits the information on planned changes to specified dates and periods that fall or end on or after 28 February 2027 “but still before 1 June 2027” (our translation), and expressly includes type 1. Neither appears in the catalogue in this form. The catalogue governs the audit; the FAQ is an explanation by the BSI. Because the information is part of the system description, agree early with your auditor on what they expect.

There is no special window in which any audit can be performed against C5:2020 until the end of May 2027. Only the position of the specified date or period counts.

What information on planned changes is needed?

If an audit period ends on or after 28 February 2027, the provider describes in the system description how it intends to adjust its controls to C5:2026, for each change and as applicable with the criterion, nature of the change, implementation status and implementation date (section 3.5). The auditor only checks whether this information is fairly presented; how to write it is shown on Writing information on planned changes.

How do you move from C5:2020?

Providers with a system of internal control based on C5:2020 have to adjust their controls to C5:2026; as an example, the catalogue mentions extending a control’s scope to cover a newly required aspect. These adjustments count as significant changes and belong in the system description (section 3.5). Our recommended order:

1. Set the revision for each audit. Use the table above to determine for the next two audits which revision applies and whether information on planned changes is needed.
2. Map via the change history. Assign each existing criterion to its new ID and mark the changed subcriteria.
3. Assess the new criteria. Sort the 39 new criteria by whether they apply to the service. A criterion can only be excluded with a justification based on the nature and design of the service or on the provider’s policies, procedures and measures, never on the grounds that controls are missing or ineffective (section 3.4.3, details on C5 system description). Which of the new criteria affect your service and where the gaps are is shown by a C5 readiness assessment. You prioritise the applicable measures by what blocks the audit and by dependencies.
4. Update the system description. Add significant changes and planned changes, see C5 system description.
5. Agree with the auditor. Record period, revision and expectations for the information before the period begins.

If you have used a cross-reference to ISO/IEC 27001 so far: the BSI has announced the table for C5:2026, but on 1 November 2026 it had not yet been published. According to the catalogue, such a table only shows thematic proximity, not fulfilment.

Example: annual audit cycle

Fictitious example, not a client. A SaaS provider is audited annually with type 2, each period running from 1 January to 31 December.

With this cycle, the first audit under C5:2026 therefore covers 2028. An alternative would be to shorten the 2027 period to 1 January to 31 May 2027 and be audited against C5:2026 from 1 June 2027. This shortened period also ends after 28 February 2027 and therefore needs information on planned changes. Five months lie within the three to twelve months the catalogue says a period should cover, but the catalogue generally recommends keeping the period length constant. Whether this is worthwhile depends on when customers expect a report under C5:2026. This choice belongs in the discussion with your auditor.

What does C5:2026 mean for Section 393 SGB V?

Section 384 SGB V (Book V of the German Social Code) defines the “current C5 attestation” by reference to the C5 catalogue “in its currently valid version” (our translation). Our reading: as soon as the catalogue provides for C5:2026 for an audit, that revision also applies for Section 393. How the Federal Ministry of Health interprets this has not been published; by its own account, the BSI does not interpret Section 393. Each case needs a legal assessment. The legal basis and deadlines are on Section 393 SGB V.