After the first report
Preparing for and supporting your C5 follow-up audit
After the first C5 report come type 2 reports, usually annually according to the BSI FAQ; the catalogue does not prescribe a fixed cycle. Each period has to be evidenced on its own. We support you through the audit period with a calendar for the controls, a plan for the deviations from the previous report and the move to C5:2026. The audit opinion comes from your auditor; Blackfort Technology does not issue attestations.
What comes after the first C5 report
Follow-up audits are always type 2 audits. The catalogue limits type 1 reports to the initial engagement and recommends a consistent audit period (sections 3.4.4 and 3.4.11). According to the BSI FAQ, C5 audits are usually repeated annually, and customers typically agree that they will receive all subsequent reports. If you promise reports without gaps, you therefore plan the periods to follow each other without a gap.
In the type 2 period, what counts is that every control ran as described and that this can be evidenced. A criterion is already not met if a single subcriterion is not met, and deviations appear in the report even if the auditor rates the criterion as achieved overall. If a deviation that was already in the previous report is found again, the new report has to refer to it and explain why it has not yet been effectively remedied (section 3.4.12).
Then there is the move to C5:2026. C5:2026 applies to type 2 periods beginning on or after 1 June 2027; a period that begins before and ends after that date should comprise C5:2020 only, and if it ends on or after 28 February 2027, information on planned changes belongs in the system description (section 3.5). Which revision applies to your next periods is shown with a calendar example on the C5:2026 page.
What we prepare with you for the follow-up audit
Six building blocks, tailored to your previous report and your period. You can commission individual building blocks or support over the whole period.
Does every control run in the period?
Control calendar
By our count of the German version 1.1.0, 25 basic subcriteria specify an at least annual cycle, such as access reviews, recovery tests, penetration tests, tests of the continuity plans, internal audits and the review of the service organisation directory. We place each of these controls in the period with a date, an owner and a deputy, early enough to allow a repeat.
What is still open?
Close deviations from the previous report
For each deviation: cause, corrective and preventive action, the date from which it takes effect, and the evidence that it works in the new period. This produces the information the provider gives on each deviation under section 3.4.12.
Is the evidence complete?
Secure evidence as you go
An evidence register kept up to date during the period, with source, owner and time reference for each item of evidence. Each quarter we check with you whether the evidence is complete, instead of searching for it at the end.
Evidence registerWhat changed during the period?
Record changes and events
For type 2, significant changes to the system of internal control and significant events such as security incidents belong in the system description, without revealing points of attack. We record them during the period, not only when the report is due.
Changes and eventsWhen does C5:2026 come?
Plan the move to C5:2026
Comparison of your controls with C5:2026 using the BSI change history, assessment of the 39 new criteria, a plan for the adjustments and, where needed, the information on planned changes in the system description. Adjusted controls count as significant changes.
C5:2026 and the transitionWhat does management base its statement on?
Basis for the management statement
Management needs its own basis for its management statement; the audit does not replace the provider’s own monitoring (section 3.4.5.2). We prepare reports from the control calendar and the deviation plan so that management can base its statement on them.
Management statement
What you receive
Work results for use within your company, built so that your team can carry them on in the next period. The details are set out in the proposal.
01
Control calendar for the period
All recurring controls with date, frequency, owner and evidence, aligned with your audit period.
02
Deviation plan
Each deviation from the previous report with cause, action, effective date and evidence, as the basis for your information in the report.
03
Quarterly review
A short report each quarter: which controls ran and are evidenced, where evidence is missing, what has to be done by the next quarter.
04
Updated system description
A draft with the significant changes and events of the period and, if needed, the information on planned changes under section 3.5.
05
C5:2026 transition plan
Mapping of your controls to C5:2026, assessment of the new criteria and a plan up to the first period under C5:2026.
06
Preparation for the audit procedures
We go through the evidence and processes with your specialist teams so that the auditor’s inquiries and samples run smoothly.
Fictitious example: deviation plan from a previous report
This is what an extract from the deviation plan can look like. The example is made up and does not relate to any client: a billing platform for home care services with a first type 2 report over twelve months and three deviations.
| Criterion | Deviation in the previous report | Cause | Action | Effective from | Evidence in the new period |
|---|---|---|---|---|---|
| IAM-05 | Access review for the support tool not performed | Tool missing from the list of systems | Tool added to the inventory, review in the control calendar | Month 1 | Signed-off review in month 2 |
| OPS-08 | Recovery test only for the database, not for the object storage | Test plan older than the architecture | Test plan per data store, test of both storage systems | Month 2 | Test records for both storage systems |
| SSO-05 | Report of the email delivery service not reviewed | No owner named | Owner named, annual review with a deadline | Month 1 | Reviewed report with date and result |
Fictitious, shortened example, not a client. Under section 3.4.12, the information on cause and actions goes into a separately marked section of the report; the auditor does not express a conclusion on it.
How we support the follow-up audit
The process follows your audit period. We set out the scope in writing after the initial call.
1
Evaluate the previous report
Collect and assess deviations, auditor’s remarks and customer questions from the last report.
2
Calendar and responsibilities
Set the control calendar, deviation plan and owners before the period begins.
3
Support during the period
Quarterly review of the evidence, recording changes and events, follow-up on missing controls.
4
Preparing for the audit
Update the system description, bundle the evidence, prepare specialist teams for inquiries.
5
Evaluating the new report
Take on deviations and remarks and adjust the calendar for the next period.
The audit itself is performed by your auditor. If you wish, we take part in meetings with the auditor, but we do not speak for the auditor.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
If a control fails during the period
If a control fails or evidence is missing, the period is not lost. For each deviation the auditor is to consider, among other things, whether the provider identified it through its own monitoring, which corrective actions followed, and whether compensating controls address the risk in such a way that the criterion is still met with reasonable assurance (section 3.4.12). If the provider detected a deviation itself, it states in the report when and through which measures. In our view this shows customers that monitoring works; it is therefore worth detecting, documenting and remedying failures early.
Whether the opinion is modified is for the auditor to decide. The catalogue provides for the opinion to be modified (qualified, adverse or disclaimed), for example where controls did not operate effectively in all material respects or the auditor cannot obtain sufficient evidence.
Changing the auditor or the scope
A follow-up audit is a good time to reconsider the scope or the auditor, for example when a new service is added or customers have different requirements. New services or regions extend the subject matter of the audit; new controls for them have to be running at the start of the period. What to look for when choosing an auditor is shown on the page on selecting an auditor.
What the support is not
To set expectations:
- Not an attestation and not a pre-audit by an auditor. Blackfort Technology does not issue attestations; the audit opinion is given by your independent auditor alone.
- Not taking over your controls. Your teams perform the controls; we plan, pre-check the evidence and point out gaps.
- Not a statement on behalf of management. Your management gives the management statement on its own basis; we do not sign anything for you.
- No legal advice, for example on Section 393 SGB V or on contractual commitments to your customers.
We do not publish prices on this website. After the initial call you receive a proposal with a fixed scope.
Frequently asked questions
Do you also support us if the initial audit was prepared with another consultant?+
Yes. The starting point is your last report with its deviations and your system description; the control calendar and deviation plan are built from them, regardless of who prepared the first audit.
Does the new period have to follow directly on from the old one?+
The catalogue does not require this, but it recommends a consistent period. If customers expect reports without gaps, which according to the BSI FAQ is typically agreed, the periods should follow each other without a gap.
What happens to deviations we do not remedy by the follow-up audit?+
The new report refers to the previous report, and the provider explains why the deviation was not yet subject to effective actions, with the planned actions and timing (section 3.4.12). Customers can therefore see how long a deviation has been open.
Who talks to the auditor during the audit?+
You do. Audit planning, inquiries and evidence run between your teams and the auditor. If you wish, we take part in meetings, but we do not speak for the auditor and make no audit statements.
Do we need another C5 readiness assessment for the follow-up audit?+
Usually not in full. For the move to C5:2026 or a new service in scope, we recommend a comparison against the new criteria; for the current period, the control calendar and deviation plan are enough.
Read more
- C5:2026: what is new, moving from C5:2020 and the transition period
- C5 significant events and changes in a type 2 report
- C5 management statement: what management confirms
- BSI C5 audit process: steps, audit standards and timeline
- Choosing a C5 auditor: qualifications and IDW PS 860
- C5 documentation: keeping an evidence register for the audit
- C5 readiness assessment: gap analysis, action plan and timeline
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (PDF), sections 3.4.4, 3.4.5, 3.4.11, 3.4.12, 3.4.13 and 3.5, licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: Kriterienkatalog Cloud Computing C5:2026, version 1.1.0 (PDF, German), basis of our count of subcriteria with an at least annual cycle, licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: C5 FAQ (German), question “Wie oft kann/muss man ein C5-Testat erneuern/anfordern?” (how often a C5 attestation can or must be renewed or requested) (retrieved 2026-11-01)
- BSI: C5:2026 change history (Excel) (retrieved 2026-11-01)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-01
Get in touch
Prepare your follow-up audit
Tell us briefly when your next audit period begins and which deviations the last report contains. In the initial call, by phone or video as you prefer, we agree the scope of the support.