The BSI C5 audit process, step by step

This page explains the C5 audit plainly: who audits, against which standards, in which steps, and what the report contains. It then works backwards through an example to show when a project has to start so that the report is ready for a fixed customer date. What customers expect as evidence is covered on C5 attestation.

Who performs a C5 audit?

An independent auditor, usually engaged by the cloud service provider. The BSI is not involved in any part of the audit or reporting and does not review reports (catalogue, section 3.1; BSI FAQ). The BSI FAQ adds that only Wirtschaftsprüfer (German public auditors) can issue a C5 attestation, while section 3.4.13 of the catalogue also covers practitioners who are not public auditors. When choosing a C5 auditor, what matters is independence and the experience or qualifications the catalogue requires of the people responsible (section 3.4.2).

On the provider side you need management, who sign the management statement, an owner for information security, and the teams whose controls will be tested. Blackfort Technology supports providers up to audit readiness; we do not issue attestations.

Which standard applies: ISAE 3000, IDW PS 860 and engagement types

Every C5 audit is based on ISAE 3000 (Revised), the international standard for assurance engagements other than audits or reviews of historical financial information. The German IDW PS 860 (“IT-Prüfung außerhalb der Abschlussprüfung”, IT audits outside the audit of financial statements), which is in line with ISAE 3000 (Revised), and other national equivalents are accepted as well (section 3.2). ISAE 3000 distinguishes reasonable and limited assurance; C5 requires reasonable assurance (section 3.4.1). For individual questions the auditor also draws on further standards such as ISAE 3402.

Within that framework the catalogue allows two engagement types (section 3.4.1):

Separately, a Type 1 report covers design as of a date, a Type 2 report design and operating effectiveness over a period. Type 1 is for initial engagements only; the Type 2 period should be three to twelve months (sections 3.4.4 and 3.4.11). See Type 1 or Type 2.

Phases of a C5 audit

The catalogue sets requirements for the audit and the report, not a project plan. The phases below are our breakdown, with the catalogue references for each.

1. Preparation. Define the scope (C5 scope), assess gaps against the criteria, remediate, collect evidence and write the system description. In an initial engagement, controls not yet fully executed can be evidenced through planning records or a non-production environment configured like production (section 3.4.11).
2. Auditor selection and engagement. Before accepting, the auditor checks professional duties including independence. Those who supervise the engagement and review the results need the experience or certifications listed in the catalogue, and the report confirms this (section 3.4.2).
3. Audit planning. Agree services and regions, engagement type, report type, date or period, additional criteria and the method for subservice organisations (carve-out or inclusive, section 3.4.6). The BSI FAQ notes that the provider sets the planning and timing and agrees them with the auditor.
4. Testing. The auditor evaluates whether the description is fairly presented and the system implemented (3.4.7), whether controls meet each criterion at subcriterion level (3.4.8), whether they are suitably designed (3.4.9) and, for Type 2, whether they operated effectively throughout the period (3.4.10, following ISAE 3402.24-29). Typical procedures are inquiry, observation, inspection and reperformance (3.4.13).
5. Gaps and deviations. The auditor reports gaps to the provider; additional evidenced controls are added to the description (3.4.8). A criterion is not met if one subcriterion is not met. For each deviation the provider adds when it detected it, whether it was in a previous report and what corrective action is planned (3.4.12).
6. Reporting. The auditor issues the report based on ISAE 3402.53 (3.4.13). Management signs its statement and needs its own reasonable basis for it (3.4.5.2).

What the C5 report contains

For an attestation engagement the report follows ISAE 3402.53 and contains the auditor’s report, the management statement, the system description, the controls with test procedures and results, and optionally other information from the provider (section 3.4.13). Deviations are included even where the auditor judges the criterion as achieved overall; what each part tells your customers is covered on C5 attestation.

How long does a C5 audit take?

The catalogue only defines the audit period: three to twelve months as a recommendation for Type 2, a specified date for Type 1. It does not say how long preparation, testing or reporting take. That depends on your starting point, your scope and your auditor, so raise it with the auditor early.

Three stretches drive the timeline: getting the controls in place, the period during which they must demonstrably operate (Type 2), and the time from period end to the final report. Our recommendation: for Type 2, have the controls running at the start of the period; otherwise there is no evidence of effectiveness for the first weeks. For a first engagement, section 3.4.11 allows alternative evidence.

The catalogue revision also depends on the period: C5:2026 applies to Type 1 dates and Type 2 periods from 1 June 2027, while a period that starts before and ends after that date should be audited against C5:2020 only (section 3.5). Where a period ends on or after 28 February 2027, the description also needs information on planned changes; the catalogue sets no end date for this, while the BSI FAQ limits it to periods ending before 1 June 2027.

Planning backwards from a customer deadline

If you know when a customer wants to see the report, count back from that date: report date, reporting time, audit period, remediation, gap analysis.

Worked example, fictitious. A SaaS provider has to give a hospital group a Type 2 report by 15 December 2027. Assumptions for the example, to be confirmed with your auditor: two months for completion and reporting after the period ends, six months for remediation, one month for the gap analysis.

The bottleneck is visible: just over thirteen months from kick-off to deadline here, and the audit period should not be shorter than three months. If the deadline is closer, there are three options to discuss with customer and auditor: a Type 1 report as the initial engagement, if the customer accepts it; a Type 2 period of exactly three months; or a later date. A Type 1 report is not a prerequisite for Type 2, but the next engagement has to be Type 2 (section 3.4.11).

For healthcare providers in Germany the deadline may come from law: Section 393(4) SGB V (Book V of the German Social Code) sets when a Type 1 and when a Type 2 attestation counts as current, since 1 January 2026 also for newly marketed systems; details and context on Section 393 SGB V.

After the first report

An attestation always covers a past period. According to the BSI FAQ, C5 audits are usually repeated every year. Subsequent engagements are always Type 2, and a consistent period is recommended (section 3.4.4). If customers expect continuous coverage, start each period where the last one ended. Work off deviations from the previous report early, before the C5 follow-up audit: for each deviation the report states whether it already appeared in the previous report (section 3.4.12).