The C5:2026 criteria catalogue: how the 168 criteria are structured

This page shows how the C5 criteria catalogue is structured and how to read it. What C5 is as a framework and who needs it is explained on BSI C5; what C5:2026 changes compared with C5:2020 and which revision applies to your audit, on C5:2026.

How is the C5 criteria catalogue structured?

The catalogue has five sections. For implementation, section 4 with the general conditions and section 5 with the criteria matter most; for the audit, section 3 as well (catalogue, sections 1.1 and 2.1).

The German version is called “Kriterienkatalog Cloud Computing C5:2026” and is available as version 1.1.0 of 11 August 2026, the English version as “Cloud Computing Compliance Criteria Catalogue (C5:2026)” in version 1.0.1. Besides the PDF, the BSI offers an editable version, a change history and, for the first time, a machine-readable version in YAML. The announced cross-reference table to international standards was not yet listed as a download on 1 November 2026.

What are basic criteria and additional criteria?

Basic criteria are the mandatory programme, additional criteria the optional extra for a higher protection need. In the BSI’s view, the basic criteria reflect the minimum level of information security a cloud service has to offer when customers use it to process information with a normal protection need. They define the minimum scope of every audit according to the catalogue. For customers with a higher protection need, additional criteria can be a starting point (sections 2.1 and 3.4.3).

Each criterion is broken down into subcriteria. Additional subcriteria come in two types that work differently in the audit. The German version calls them “verschärfend” and “erweiternd”, the English version “sharpening” and “complementing”.

The catalogue puts it briefly: “A sharpening additional subcriterion thus acts as stricter replacement for the basic subcriterion it sharpens” (section 2.1). In total there are 623 subcriteria. Not every criterion has additional subcriteria: in the English version 79 of the 168 criteria have at least one, in the German version 80, because one complementing subcriterion has been moved from AM-01 to AM-02 there.

The provider decides which additional criteria go into the audit, including individual subcriteria of a criterion. According to the catalogue, the selection should be based on the contractual requirements of the customers, and the rationale belongs in the system description (section 3.4.3).

How do I read a criterion ID?

An ID names the domain, criterion, subcriterion and type. Example IAM-04.02B:

• IAM: abbreviation of the domain, here Identity and Access Management,
• 04: number of the criterion within the domain, here IAM-04 on withdrawing and adjusting access rights,
• 02: number of the subcriterion,
• B: basic subcriterion (AS sharpening, AC complementing).

A sharpening subcriterion always names the basic subcriterion it replaces, for example “IAM-03.03AS, sharpening IAM-03.03B”. Numbering within each domain has no gaps, for example OPS-01 to OPS-35 or CRY-01 to CRY-19.

Two reading notes with consequences for the audit: the subcriteria of a criterion are to be read together, not in isolation (section 2.1). And a criterion is not met if even one of its subcriteria is not met; the auditor reports the deviation (sections 3.4.12 and 3.4.13). Your controls should therefore be mapped to each subcriterion, not just to the criterion.

What does a criterion contain besides the requirements?

Every criterion has the same structure: Basic Criteria, Additional (Sharpening), Additional (Complementing) and Supplementary Information. If a part is missing, it shows a dash.

• Supplementary Information, “About the Criteria”: explanations, examples and clarifications of terms, each marked with the subcriteria they refer to (“Applicable to:”). They help with interpretation, for example when a criterion uses a term from another criterion.
• “Complementary Customer Criteria”: pointers to where customers typically have to cooperate themselves. By our count, 60 of the 168 criteria in the English version contain such entries; the others show a dash. The catalogue stresses that the list is neither exhaustive nor generally valid for all services (section 2.1).

The complementary customer criteria are part of the catalogue. They are distinct from the complementary customer controls (also called complementary user entity controls, CUEC) that you as the provider assume for your specific service in your system description. How to turn both into a responsibility matrix with your customers is shown on complementary customer criteria.

Which criteria go into the audit?

All applicable basic criteria, plus the additional criteria you select. You may only exclude a criterion with a justification based on the nature and design of the service or on your principles, procedures and measures, such as IaaS-only criteria for a SaaS service. An exclusion is not permitted because controls are missing or not effective, or because the provider is not willing or able to demonstrate conformity (section 3.4.3). Some criteria state their own applicability: OPS-32 on confidential computing only applies if the service offers such capabilities.

An exclusion is not the same as the carve-out method for subservice organisations, such as a data centre operator: there the criterion remains applicable, only the controls at the subservice organisation are outside the audit. How to draw that line is explained on C5 scope; how to word exclusions and the selection, on C5 system description.

The 17 domains at a glance

The 17 areas follow the structure of the control objectives in ISO/IEC 27001:2013 Annex A (section 2.2); for the content, the BSI considered the 2022 edition of the standard (sections 1.1 and 2.3). What you can carry over from an ISO 27001 ISMS is shown on C5 and ISO 27001. Names as in the English version 1.0.1, counts according to section 5; the description in the last column is our own summary. Domains with their own implementation page are linked by name.

Two domains seem to overlap at first glance: IAM governs access by the provider’s staff, usually privileged users; authentication, sessions and roles of your customers’ users are in PSS-05 to PSS-09. In C5:2020 the IAM domain was still called IDM.

What are the general conditions GC-01 to GC-06?

The general conditions in section 4 are details that customers use to assess whether the service suits their use case and to compare reports from different providers. They are not among the 168 criteria, but belong in every system description:

• GC-01 Information on applicable law, jurisdiction, countries, partitions, regions, zones and locations
• GC-02 Information on availability and incident handling during regular operation
• GC-03 Information on recovery parameters in emergency operation
• GC-04 Information on the approach to ensuring service availability
• GC-05 Information on how investigation requests from government agencies are handled
• GC-06 Information on certifications or attestations

GC-06 does not require certificates, only transparency about existing ones.

Example: a SaaS provider draws up its criteria list

Fictitious example, not a client. A provider of shift planning software for care homes runs its service as SaaS on the infrastructure of a large cloud service provider. A group of care home operators asks for a C5 report and, in the contract, for phishing-resistant multi-factor authentication for administrators. This is how the criteria list comes about:

1. Adopt all basic criteria. All 168 criteria go on the list, each with its basic subcriteria.
2. Justify applicability. The service does not offer confidential computing; OPS-32 and OPS-33 are justified as not applicable with reference to the nature of the service. Physical security (PS) remains applicable, the data centre controls are with the platform operator under carve-out.
3. Select additional criteria according to the contract. The customer’s requirement corresponds to the complementing subcriterion IAM-06.03AC. The provider includes it and states the rationale for the selection in the system description. It leaves out further additional criteria for now.
4. Map controls to each subcriterion. For every subcriterion the list states which control covers it, who owns it and which evidence it produces.
5. Mark the customer side. Where the catalogue lists complementary customer criteria, the provider checks which customer controls it assumes for its service.

This list is the basis for the system description and for a C5 readiness assessment, which measures the gap to the current state for every subcriterion.

May I use and quote the catalogue?

Yes, within limits. According to the notice in the document, the catalogue is licensed under CC BY-ND 4.0: it may be shared unchanged and with attribution, including commercially. Adapted versions and translations of the catalogue text may not be distributed. Criteria IDs and your own explanations are not adaptations; short quotations with a source reference are possible. If you document in German, quote from the BSI’s German version; if you document in English, from the English version. Where exactly the line lies in an individual case is a legal question; this page is not legal advice.