Blackfort TechnologyC5-Readiness
Contact
DEEN
C5-Readiness

BSI C5

C5 check: where does your cloud service stand before attestation?

In eight short steps, the self-check helps you place where the demand for C5 evidence comes from, what your scope and your existing evidence mean and where the biggest areas for action lie. The result appears straight away, and you do not need to give any contact details for it.

Book an initial call
Clipboard with a partly ticked checklist next to a closed laptop on a dark desk

Last updated: 2026-11-01

The C5 check is a first assessment of where you stand, for cloud and SaaS providers preparing evidence under the BSI C5 catalogue. In a few minutes it shows which questions you should settle first and which pages help with them. An assessment of each individual criterion only comes with the C5 readiness assessment.

Start the self-check

Eight short steps, about five minutes. The evaluation runs in your browser and appears straight away; your answers are neither stored nor transmitted. They only leave your browser if you explicitly send the result to us at the end.

Our cookieless analytics (Matomo) only records that the check was started and the result was shown, and whether you then clicked the contact link, without your answers. Please do not enter any personal data or health data; the check does not ask for them either.

What the check asks

  • Requirement: whether an enterprise customer, a tender, customers in the healthcare sector, a federal authority or the financial sector expects the evidence.
  • Service and platform: the service model and whether the service runs in your own data centre, on your own hardware in rented space (colocation) or with a third party. This determines how the scope is drawn.
  • Existing evidence: an ISO 27001 certificate, a SOC 2 report or a C5 attestation under C5:2020 or C5:2026.
  • Deadline and report type: by when a report should be available and whether you are aiming for type 1 or type 2.
  • Maturity in eight areas: policies, risk management, access rights, operations and logging, development, supplier management, business continuity and the system description, each on a simple scale.
Diagram “From self-check to audit path”. Left, “Your answers”: requirement (who asks for the evidence?), service and platform (service model, own data centre, colocation or with a third party), existing evidence (ISO 27001, SOC 2, attestation under C5:2020 or C5:2026), deadline and report type. In the middle, “Maturity in eight areas”, each with a simple scale: policies, risk management, access rights, operations and logging, development, supplier management, business continuity, system description. Right, “Your result”: orientation with indications of possible requirements and a link to the page that explains the topic; areas for action, highlighted in gold: areas that, by your own assessment, are missing or only partly in place; timing: what the catalogue specifies on report type and audit period, a note on your deadline. Below: orientation, not an audit and not legal advice; only the C5 readiness assessment shows which individual criteria are met.
Tap the graphic to open it at full size.What the C5 check asks and what it returns. Own illustration.

How to read the result

The result has three parts. The orientation names indications of possible requirements that follow from your answers and links to the page that explains the topic. The areas for action rank the areas that, by your own assessment, are missing or only partly in place. The timing part sums up what the catalogue specifies on report type and audit period and gives a note on how well your deadline fits. For detailed planning, work back from the deadline as described on the page on the C5 audit process.

Limits of the self-check

The check rests only on your own assessment and on a few simplified questions. It gives indications of possible requirements, but it makes no legal statement on whether a provision such as Section 393 SGB V applies to your service. The legal assessment of the individual case is a matter for your legal advisers. Whether an attestation is issued is decided by the auditor alone. Blackfort Technology does not audit and does not issue attestations.

The check does not ask for any personal data or health data, and you do not upload any audit reports or documents.

Frequently asked questions

Are my answers stored?+
No. The evaluation runs entirely in your browser, without cookies and without entries in the browser’s storage. If you reload the page, the answers are gone. Only if you open the form in the result and explicitly send the result to us do we transmit your answers and the result together with your name and email address. Details are in the privacy policy.
Does the check tell me whether I need a C5 attestation?+
It shows indications of possible requirements based on your answers, for example from customer contracts, tenders or Section 393 SGB V. Whether an obligation exists depends on the individual case and needs legal clarification. What an attestation states is explained on the page on the C5 attestation.
How accurate is the assessment of the areas for action?+
As accurate as your self-assessment. The check groups many criteria into each area. Only a criterion-by-criterion comparison, as provided by the C5 readiness assessment, shows which individual criteria are met.

Read more

Sources

This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).