Finding cloud providers with a C5 attestation and requesting the right evidence

Anyone searching for “BSI C5 certified providers” is in fact looking for cloud services with a C5 attestation. According to the BSI FAQ there is no C5 certificate. The evidence is an audit report by an independent auditor on one or more services, see C5 attestation. This page is for procurement, information security and business units who are looking for a provider or want to assess a bidder.

Is there a directory of all providers with a C5 attestation?

No. The BSI states in its FAQ that cloud service providers decide themselves whether to report publicly on C5 audits, and that it is therefore not possible to keep a guaranteed complete list. Because the BSI has no supervisory role over C5 audits and is obliged to remain neutral towards the market, it does not keep a list of C5 attestations itself. It is also not involved in the audit or the reporting (section 3.1 of the catalogue) and does not review the reports.

What this means for you: every list you find is a selection, not an official confirmation. Only the report shows whether a specific service is attested.

Publication under Section 393(7) SGB V

German healthcare has a statutory publication. Under Section 393(7) SGB V (Book V of the German Social Code), the Competence Centre for Interoperability in Healthcare (Kompetenzzentrum für Interoperabilität im Gesundheitswesen), which is based at gematik, publishes information on attested cloud systems and cloud technology on its platform, on application. The application must include a checklist on the complementary customer criteria. The list is on the Competence Centre’s website at ina.gematik.de.

What the list shows and what it does not follows from the Competence Centre’s page “C5-Testate” (retrieved 1 November 2026):

The law and the Competence Centre’s page differ on one point. Section 393(7) sentence 2 requires the checklist on the complementary customer criteria to be submitted with the application, while the page lists the obligations to cooperate (in German “Mitwirkungspflichten (korrespondierende Kontrolllisten)”) as optional information. If an entry lacks the checklist, request it from the provider.

The list helps you find providers and answer the question which controls a healthcare provider has to implement itself. It does not replace evaluating the report: neither the report nor its audit opinion is published there. What Section 393 SGB V requires in detail and of whom is explained on Section 393 SGB V. Whether it applies in an individual case needs a legal assessment.

Where else you can look

• The provider itself. Providers can describe existing attestations in their security documentation. What counts is the report: ask for it directly. The answer quickly shows you whether there is an attestation for the service you are looking for.
• The tender or the supplier questionnaire. Word the requirement so that only suitable evidence meets it (template below). The requirement then sorts the bidders for you.
• The platform provider. If an application runs on a cloud platform, the platform can have an attestation while the application has not been audited. Keep the two apart in your search. What a platform attestation covers is explained on C5 scope.

Wording the requirement correctly

Vague requirements such as “C5 certified” leave open which service, which type and which period is meant. Our template for a supplier questionnaire or a statement of work, as a proposal for you to adapt:

Set the values in brackets to suit your needs. Whether you accept a type 1 report for an initial engagement depends on your risk and your deadline. Type 1 only covers the design as of a specified date. Section 393 SGB V has its own deadlines, see Section 393 SGB V, and the route via an ISO 27001 certificate with a remediation plan is covered on C5 Equivalence Ordinance.

Which evidence you should request

1. The complete report. According to the BSI FAQ it belongs to the provider, who sets the terms on which it is passed on. Expect a non-disclosure agreement. A cover page, a confirmation letter or a logo is not enough.
2. A commitment to subsequent reports. According to the FAQ, audits are usually repeated every year. Customers typically have it confirmed in the contract that they will receive all subsequent reports.
3. The list of CUEC. It shows what you have to do yourself so that the criteria are met.
4. Reports of key subservice organisations. Under the carve-out method, the audit does not extend to their controls.
5. Statements on deviations. They are in the report. Ask about the status of the measures since the end of the period.

How to evaluate the report is explained step by step on Reading a C5 report.

Warning signs when looking for a provider

Example: a laboratory looking for a results portal

Fictitious example, not a client. A medical laboratory wants to deliver test results to referring practices through an online portal and is buying a cloud service for this. It proceeds as follows:

1. Search: It goes through the list under Section 393(7) and finds no suitable service there. It draws no conclusion from this, because the list only contains providers that have applied.
2. Requirement: It sends the template to three providers and asks for type 2, region Germany, subsequent reports and the CUEC list.
3. Responses: Provider A presents a type 2 report for its portal. Provider B refers to the C5 attestation of its cloud platform. Its application itself has not been audited. Provider C holds an ISO 27001 certificate and a remediation plan under the C5GleichwV.
4. Assessment: The laboratory evaluates A’s report and has the responses from B and C legally assessed before considering them further.