C5 Equivalence Ordinance: ISO 27001 or CCM with a remediation plan under Section 393 SGB V

This page describes the route via the C5 Equivalence Ordinance (C5GleichwV): which standards it accepts, what the remediation plan must contain, which deadlines apply and who the plan has to be provided to. The legal basis itself, meaning who Section 393 SGB V (Book V of the German Social Code) applies to and which attestations count when, is covered on the Section 393 SGB V page. This page reproduces the wording and is not legal advice; whether this route is open to you has to be assessed legally case by case.

What is the C5GleichwV?

Its full title is “Verordnung über gleichwertige Sicherheitsnachweise zum C5-Standard für Cloud-Computing-Dienste im Gesundheitswesen”, that is, Ordinance on equivalent security evidence to the C5 standard for cloud computing services in healthcare (our translation). The Federal Ministry of Health (Bundesministerium für Gesundheit) issued it in agreement with the BSI, signed on 19 March 2025 (Federal Law Gazette 2025 I no. 91). It entered into force retroactively with effect from 1 July 2024. The ordinance is short: an enacting formula, Section 1 on the evidence and Section 2 on entry into force.

Its basis is Section 393(4) SGB V. Under that provision, cloud processing is also permitted if, instead of a current C5 attestation, there is an attestation or certificate under a standard that ensures a comparable or higher security level. Which standards these are is set by the ministry by ordinance. That ordinance is the C5GleichwV.

Which standards does it accept?

Section 1(1) names three alternative standards:

1. ISO/IEC 27001 in its currently valid version,
2. ISO 27001 based on IT-Grundschutz by the BSI,
3. Cloud Controls Matrix (CCM) version 4.0 in its currently valid version.

An attestation or certification of the cloud service under one of these standards counts as evidence of a security level equivalent to a C5 type 1 or type 2 attestation if the requirements of Section 1(2) (remediation plan) and Section 1(3) (provision on request) are also met. A certificate alone is therefore not enough. The BSI also states in its FAQ that an ISO 27001 or IT-Grundschutz certificate does not automatically lead to a C5 attestation.

Our recommendation: check in advance whether the scope of your existing certificate covers the cloud service the evidence is meant to apply to. Section 1(1) already requires the attestation or certification “of a cloud computing service” (our translation), and the remediation plan also relates to a cloud service. A certificate for a different part of the company does little to help here.

What the remediation plan must contain

In addition to the attestation or certificate, there must be a remediation plan for the cloud service. Section 1(2) names four parts:

What the 18 and 24-month deadlines actually require

The wording requires documentation of “measures to obtain” (our translation) a type 1 attestation within 18 months and a type 2 attestation within 24 months of the milestone plan being drawn up. Whether the attestation must actually be in place by then is not expressly stated in the text. The shorthand “Type 1 in 18 months, type 2 in 24 months” is therefore inaccurate.

Our view: plan so that the reports can be in place within these deadlines. A plan that only shows contract negotiations gives customers little assurance. Under the C5 catalogue, a type 1 report is not a prerequisite for type 2, and the catalogue provides for it only for the first engagement; type 2 follows after that. Whether a type 1 interim step makes sense for your timeline is covered on the type 1 or type 2 page.

The ordinance itself contains neither an expiry date nor a transition period of its own. Only the steps in the remediation plan are time-limited. It does not expressly say what applies after the 24 months if there is no C5 attestation. We therefore treat this route as a bridge to a C5 attestation and do not plan it as a permanent solution.

Who the plan has to be provided to

Under Section 1(3), the remediation plan and the attestation or certificate must be provided without delay on request to:

• the healthcare providers under Chapter Four of SGB V or the health and long-term care insurers that commission the cloud service,
• the competent supervisory authorities.

The plan is therefore a document that third parties will read. Write it so that a hospital buyer or a supervisory authority can follow gap, action and date without having to ask. Keep dated versions so that you can demonstrate progress.

Which criteria is the mapping done against?

Against the C5 basic criteria, because Section 393 and the remediation plan refer to them; additional criteria are not part of it. The C5:2026 catalogue has 168 criteria with 462 basic subcriteria, and a criterion is only covered if all of its basic subcriteria are covered. How to map an ISMS under ISO 27001 against C5 and what is typically missing is shown on the C5 and ISO 27001 page.

The ordinance does not say which version of the catalogue the remediation plan should be based on. Our recommendation: the version against which the attestation will later be audited. For type 1 specified dates and type 2 periods on or after 1 June 2027, that is C5:2026. For the order of actions in the plan, we recommend closing first the gaps that other actions depend on, and starting early on actions whose operating effectiveness a type 2 audit will want to see demonstrated over a whole period.

Example: timeline for a SaaS provider with an ISO 27001 certificate

Fictitious example. A provider of documentation software for home care services holds an ISO/IEC 27001 certificate whose scope covers development and operation of the software. It has no C5 attestation. A customer within the scope of Section 393 asks for evidence.

• Month 0 (1 February 2027): mapping against the basic criteria, gaps and arrangements documented, milestone plan drawn up and dated.
• By month 12 (1 February 2028): all documented gaps closed, with evidence.
• By month 18 (1 August 2028): documented measures to obtain the type 1 attestation, here a signed contract with an auditor and a specified audit date.
• By month 24 (1 February 2029): documented measures to obtain the type 2 attestation, here an audit period of at least three months that is under way.

Because the specified date and the period fall after 1 June 2027, the auditor audits against C5:2026. The provider therefore bases the mapping on C5:2026 from the outset and provides the plan and certificate to customers on request.

Watch the sentence numbers

The enacting formula of the ordinance cites “Section 393(4) sentence 4” as its legal basis, and Section 1(1) refers to “sentence 3” for the alternative evidence (our translation). Both were correct when the ordinance was issued in March 2025. On 1 January 2026, the 18-month rule for new systems was inserted as a new sentence 3 in Section 393(4) (Article 3 no. 44 of the Act on Extending Powers and Reducing Bureaucracy in Nursing Care, Federal Law Gazette 2025 I no. 371). Since then, the alternative has been in sentence 4 and the enabling provision in sentence 5; the text of the ordinance still cites the old sentence numbers (as of 1 November 2026). If you refer to the ordinance in contracts or customer documents, describe its content and do not copy the sentence number without checking it.