C5 attestation: what the BSI C5 report proves to your customers

This page explains which evidence a cloud provider presents for BSI C5 and what that evidence tells a customer. Choosing between report types is covered under C5 Type 1 or Type 2, the audit itself under C5 audit process.

Is there a C5 certification?

No. According to the BSI FAQ, there is no certification scheme for C5 and therefore no C5 certificate. The evidence is an attestation: an audit report on one or more cloud services in which at least all basic criteria were tested. Buyers and tenders still ask for “C5 certification” or a “C5 certificate”; they usually mean the attestation report. In a tender, confirm this through a bidder question.

The difference is the procedure. A certificate involves three parties: the organisation, an auditor and a certification body that issues the certificate. An attestation involves two: the provider and the auditor it engages. The BSI explains that it chose established international assurance standards over a new national certificate because many cloud providers operate internationally.

The BSI FAQ also confirms there is no official C5 logo. In practice, describe what you have precisely: a “C5 Type 2 attestation for service X, period from … to …”. Wording that presents the company as certified misstates the facts twice: no certificate exists, and the audit covers a service.

Who issues a C5 attestation?

An independent auditor engaged by the provider. The catalogue requires reasonable assurance engagements under ISAE 3000 (Revised) or a national equivalent such as the German IDW PS 860 (sections 3.2 and 3.4.1). Under the English version 1.0.1 of the catalogue, the team members who supervise the engagement and review its results need three years of relevant professional experience with IT audits in a public audit firm or one of the listed professional examinations or certifications, such as CISA, ISO/IEC 27001 Lead Auditor or CCSP, and the report has to confirm this (section 3.4.2). The newer German version 1.1.0 words the experience requirement differently: it asks for IT audit experience under the relevant ISAE standards and does not refer to an audit firm.

BSI sources differ on who may attest. The German-language BSI FAQ states that only Wirtschaftsprüfer (German public auditors) can issue a C5 attestation. The catalogue itself, in section 3.4.13, provides for practitioners who are not public auditors, who must then state equivalent professional requirements. Ask your customers which requirement they apply to the auditor.

The BSI is not involved in any part of the audit or reporting (section 3.1). Blackfort Technology does not attest either: we prepare providers for the audit, and the auditor issues the report.

What does a C5 report contain?

For an attestation engagement, the catalogue lists five components (section 3.4.13):

1. Independent practitioner’s reasonable assurance report. Scope, responsibilities, independence and quality management, inherent limitations and the opinion. It also states whether subservice organisations were included or carved out, and that the criteria can only be met if customers perform the complementary user entity controls (CUEC) the provider relies on.
2. Management statement. Management confirms in writing that the description is fairly presented and the controls are suitably designed, and for Type 2 that they were consistently applied as designed.
3. Description of the provider’s system, with eight minimum content items, see C5 system description.
4. Controls, test procedures and results for each applicable criterion. Test procedures have to be described in Type 1 and Type 2 reports alike.
5. Optional other information from the provider, such as management’s response to deviations. The auditor gives no opinion on this part.

In a direct engagement, components 2 and 3 are omitted. The provider does not prepare a description; the auditor presents the system as part of the report. The catalogue describes this variant as particularly suitable for providers that have not yet sufficiently documented their system of internal control (section 3.4.4). Both variants are valid for C5.

The report must also refer to a liability agreement (section 3.4.13), which matters when you share it with customers.

What a C5 attestation proves and what it does not

It shows whether the controls of a specific cloud service met the applicable C5 criteria as of a date (Type 1) or throughout a period (Type 2), as determined by the auditor. These are the points customers look at:

A C5 attestation is not evidence of data protection compliance: according to the BSI FAQ, C5 focuses on information security. It also does not settle security on the customer side; customers have to evaluate the report for their own use case.

How long is a C5 attestation valid?

According to the BSI FAQ, a C5 attestation has no fixed validity period because it always refers to a past date or period. It can only lose validity if false statements were made for the reporting period. What matters to customers is how recent it is: a report that is several years old is of little use for their risk management, so C5 audits are usually repeated every year, according to the FAQ.

• Subsequent engagements are Type 2. Type 1 is permitted for the initial engagement only (section 3.4.4).
• No gaps. The FAQ notes that customers typically want C5 coverage for the entire period they use the service and agree contractually that all subsequent reports will be provided. Plan your periods so they follow each other without gaps.
• Catalogue revision. C5:2026 applies to Type 1 dates as of or after 1 June 2027 and to Type 2 periods beginning on or after that date; earlier application is permitted. A Type 2 period that starts before that date and ends after it should cover C5:2020 only.
• German healthcare. Section 393 SGB V (Book V of the German Social Code) requires a current C5 attestation for the basic criteria and sets out when Type 1 is sufficient and when Type 2 is required, see Section 393 SGB V. Whether it applies to a specific case needs a legal assessment.

Can I share the C5 report with customers?

Yes, that is its purpose. The catalogue describes the report as the output of an independent audit that is made available to existing and potential customers (section 3.1). According to the BSI FAQ, the report belongs to the provider, who decides who receives it and on what terms. Customers have no entitlement to it, but sharing it is usually in the provider’s own interest because it answers many questions in one go.

Our recommendation: before the first report arrives, decide how you will release it, for example under a non-disclosure agreement through a named contact, and check with your auditor what the liability agreement says about passing it on. For German healthcare, the Competence Centre for Interoperability in Healthcare publishes information on attested cloud systems at the provider’s request (Section 393(7) SGB V); the application must include a checklist on the complementary customer criteria. The BSI does not keep a list of attested services.

What role does my ISO 27001 certificate play?

According to the BSI FAQ, an ISO 27001 certificate does not automatically lead to a C5 attestation, and the catalogue says results from ISO certification audits are to be assessed differently from those of an ISAE 3000 audit (section 3.3). In the report, the certificate appears as information under general condition GC-06; within criterion OIS-01, only the additional subcriterion OIS-01.01AS requires a certificate, the basic criteria do not; OIS-01.01AC requires existing certificates to be issued by an accredited body. For Section 393 SGB V, the C5 Equivalence Ordinance (C5GleichwV) accepts an ISO 27001 certificate with an action plan as equivalent evidence under certain conditions. What you can reuse from your ISMS is covered on C5 vs ISO 27001.

Example: a customer asks for your “C5 certificate”

Fictitious example, not a client. A Dutch provider of a billing platform for energy utilities holds an ISO 27001 certificate and is entering the German market. A German municipal utility’s supplier questionnaire says: “Please attach your C5 certificate.” The provider clarifies four points with procurement:

1. Evidence: the utility will usually mean a C5 attestation; the provider asks procurement to confirm this. The ISO certificate is added as supporting information under GC-06.
2. Type and date: does the utility require a Type 2 report, and by when?
3. Scope of criteria: are the basic criteria sufficient, or does the utility expect specific additional criteria such as OIS-01.01AS?
4. Service: the audit covers the billing platform in the region used under the contract, not the company.

With these answers, scope, report type and timeline can be set. What the service still needs before the attestation is shown by a C5 gap analysis.