What a C5 attestation costs and how to plan the budget

This page helps you draw up a budget your management can approve: with clearly separated items, the factors that determine the effort, and a list of the information without which no quote is comparable. How the audit itself runs is covered on the C5 audit process page.

What makes up the cost of a C5 attestation?

Three blocks, which you should plan separately because they come from different sources and grow in different ways.

There is a factual reason for the separation: whoever advises does not audit. Before accepting the engagement, the auditor has to ensure its independence (catalogue, section 3.4.2). Blackfort Technology supports you up to audit readiness; the attestation is issued by an independent auditor whom you engage separately.

What does the auditor charge for the audit?

We do not give a figure for this. On 1 November 2026 we searched for public information on fees for C5 audits. All we found were ranges on third-party websites, without report type, scope, services included and whether VAT is included, or without a traceable origin. Such a range would suggest more certainty than it can provide, so we do not publish it.

What is established: the auditor is usually engaged and paid by the cloud service provider (catalogue, section 3.1; BSI FAQ). For a reliable figure, obtain two to three quotes based on the same written scope. Only then are the quotes comparable.

What drives audit costs?

The audit effort grows with what has to be audited. The main drivers can be derived directly from the catalogue:

An existing ISO 27001 certificate does not automatically reduce the effort: results from ISO certification audits have to be assessed differently from those of an ISAE 3000 engagement (section 3.3). What can be reused is shown on the C5 and ISO 27001 page, and for SOC 2 on the C5 and SOC 2 page.

Is type 1 cheaper than type 2?

For the individual audit, the scope of type 1 is smaller, because operating effectiveness over a period is not tested. For planning over several years, however, this is what counts: type 1 is only permitted for the first engagement, and every follow-up audit is type 2 (section 3.4.4). If you start with type 1, you pay for two audits before a type 2 report exists. A type 1 report is not a prerequisite for type 2 (section 3.4.11). Whether the interim step is worthwhile depends on whether your customers accept a type 1 report; see type 1 or type 2.

What does internal implementation cost?

This is the block only you can put a figure on, because it depends on the distance between where you are today and the criteria. Plan for at least these items:

• Working time: information security, operations, development, HR, procurement and management, for the build-up, evidence and supporting the audit.
• Technical measures: for example logging and evaluation of events (OPS-13), vulnerability management, hardening, key management.
• Tests required by the catalogue: for example penetration tests (OPS-22) and tests of business continuity planning (BCM-04).
• Training and awareness for employees (HR-03).
• Managing service providers: evaluating the reports of platform and other subservice organisations (SSO-05), see C5 scope.
• Documentation: policies, control descriptions, evidence register and the system description.
• Ongoing operation: controls have to keep running after the attestation; every follow-up audit is type 2.

Our recommendation: do not run this block as a staff estimate alone. The gap analysis should give you one action per gap with an owner and a rough effort estimate, otherwise the budget remains a guess.

What does consulting cost?

Consulting is optional and does not replace either of the other two blocks. It makes sense where there is no internal experience with ISAE 3000 audits: in defining the scope, in the gap analysis, the action plan and the system description. Compare consulting quotes by scope of services and result, for example whether you end up with a prioritised action plan and a description that is ready for audit. How to start with Blackfort Technology is described on the C5 readiness assessment page.

What information do auditors and consultants need for a quote?

The more complete this list, the more comparable the quotes. We recommend sending it to all providers as a short scope sheet:

1. Service or services with service model (SaaS, PaaS, IaaS) and functionality
2. Regions and locations of processing
3. Desired report type and specified date or period, catalogue version
4. Type of engagement: attestation engagement or direct engagement
5. Desired additional criteria and the reason for them
6. Subservice organisations with their role, existing C5 reports and desired method
7. Existing certificates and reports (ISO 27001, SOC 2, ISAE 3402) with scope and period
8. State of documentation: policies, control descriptions, existing system description
9. Size of the organisation and number of teams performing controls
10. Customer deadline by which the report must be available
11. Language of the report
12. Planned follow-up audits and desired frequency

The scope sheet is available as a template on the templates page.

Example: budget framework for a SaaS provider

Fictitious example, without prices. A provider of practice management software as SaaS with 40 employees, an ISO 27001 certificate for the company and operations on an IaaS platform in Germany plans a first audit as type 2.

The table does not replace a calculation. It shows which figure comes from whom, so that nothing is budgeted twice or not at all.