C5 attestation and NIS2: which obligations the attestation does not cover

Cloud service providers with a C5 attestation ask whether that settles NIS2 for them. The short answer: no, but they have already done part of the work. This page explains how C5 and the German implementation of NIS2 relate to each other and lists in a matrix what remains alongside the attestation. It is general information; whether and how NIS2 applies to your company needs a legal assessment in each case.

Does NIS2 apply to cloud service providers?

Yes, if the type of entity, size and place of establishment fit. Germany has transposed the NIS 2 Directive, Directive (EU) 2022/2555, through the “Gesetz zur Umsetzung der NIS-2-Richtlinie und zur Regelung wesentlicher Grundzüge des Informationssicherheitsmanagements in der Bundesverwaltung” (Act implementing the NIS 2 Directive and regulating key principles of information security management in the federal administration, our translation) of 2 December 2025 (BGBl. 2025 I No. 301; on its page on the minimum standard for external cloud services, the BSI calls it the NIS2 Implementation Act (NIS2UmsuCG)). At its core is the new BSI Act (BSIG), in force since 6 December 2025, read here as amended on 22 October 2026 (retrieved 1 November 2026).

• Type of entity: Annex 1 to the BSIG lists “Anbieter von Cloud-Computing-Diensten” (providers of cloud computing services) under digital infrastructure (no. 6.1.4).
• Size: Companies of this type count as important entities if they have at least 50 employees or an annual turnover and an annual balance sheet total each exceeding 10 million euros, and as particularly important entities if they have at least 250 employees or a turnover exceeding 50 million euros and a balance sheet total exceeding 43 million euros (Section 28(1) and (2) BSIG). For the calculation, the Act refers to the Commission Recommendation on SMEs, with special rules for partner and linked enterprises (Section 28(4)).
• Jurisdiction: For providers of cloud computing services, the BSI is only competent if their main establishment in the EU is in Germany, but then for the whole EU (Section 60 BSIG).
• Financial sector exception: For financial entities under Article 2(2) of the DORA Regulation, Sections 30, 31, 32, 35, 36, 38 and 39 BSIG do not apply (Section 28(6)). What financial customers ask of cloud service providers is covered on C5 and DORA.

Our note: assess whether you are in scope for the company, not for the attested service. A provider with a single attested service may have other activities that count. Conversely, under Section 28(3), activities that are negligible in relation to the business as a whole are disregarded.

What does C5 have to do with NIS2?

Among the standards taken into account in its development, C5:2026 lists the annex “Technical and methodological requirements” to the implementing regulation to the NIS 2 Directive (Commission document C(2024)7151, section 2.3 of the catalogue). In the Official Journal this is Commission Implementing Regulation (EU) 2024/2690 of 17 October 2024. For providers of cloud computing services and certain other digital services, it lays down the technical and methodological requirements for cybersecurity risk-management measures and specifies when an incident is significant. Under Section 30(3) BSIG it takes precedence for these types of entity.

This means the content is closely related. It does not mean the requirements are met. Taken into account does not mean that every requirement of the annex appears in a C5 criterion. The catalogue itself says about mappings to other standards that fulfilment cannot be concluded from a mapping alone (section 3.3). According to our full-text search, C5 does not appear in the BSIG, the NIS 2 Directive or the Implementing Regulation (as of 1 November 2026). A C5 attestation is neither prescribed nor named there as evidence.

Two differences in subject matter are important. According to the BSI FAQ, a C5 attestation only covers the audited services in specified regions, never a provider as a whole. The obligation in Section 30(1) BSIG extends to the IT systems, components and processes that the entity uses to provide its services. And a C5 attestation assesses controls, while NIS2 also requires actions towards authorities: registration and reporting.

Responsibility matrix: what remains alongside C5

The matrix takes the BSIG obligations for important and particularly important entities and sets out next to them what a C5 project already provides. The column “Responsible” is our suggestion for the roles. Apart from management in Section 38, neither the Act nor the catalogue assigns internal roles.

The obligations for operators of critical facilities (Section 31 and evidence under Section 39) apply in addition if your company operates a critical facility. That is a separate classification this page does not cover.

Which parts of the C5 project you can keep using

The mapping of the ten minimum areas from Section 30(2) BSIG to C5 domains is our own classification, meant as a working aid. It shows where you can start with existing material, not that anything is met.

A type 2 report is particularly helpful for minimum area 6: it shows how an independent auditor assessed the operating effectiveness of a service’s controls over a period. For the company’s other systems you need your own procedures.

What customers subject to NIS2 expect from their cloud service provider

Customers that fall under NIS2 themselves have to take the security of their supply chain into account, including the relationships with their direct suppliers (Section 30(2) no. 4 BSIG). For this, the NIS 2 Directive names the specific vulnerabilities of the suppliers, the quality of their products and of their cybersecurity practices, including their development processes (Article 21(3)). A C5 report provides a lot of material for this, because it shows controls, test procedures and deviations per criterion. How customers evaluate a report is covered on reading a C5 report. Still expect questions the report does not answer, for example about your reporting routes towards the customer and about contacts during an incident.

Example: a document management provider

Fictitious example, not a client. A provider runs a document management platform for public authorities and companies as SaaS, has 80 employees and its main establishment in Germany. The platform has a C5 type 2 attestation. The company also sells locally installed archiving software, and it has internal IT with office workplaces.

• Applicability: The company provides cloud computing services and, with 80 employees, is above the threshold for important entities. The legal assessment confirms the classification, and the provider registers within the deadline.
• Scope of measures: The provider extends its risk-management measures from the platform to internal IT and to the development and delivery of the archiving software. It reuses the platform’s evidence; new evidence is created for internal IT.
• Implementing Regulation: The information security officer compares the annex to Regulation (EU) 2024/2690 against the control system and finds gaps outside the platform, which are tracked as measures with deadlines.
• Reporting: The platform’s incident process gets a step “check significance” with the thresholds from Article 7 of the Implementing Regulation and a prepared reporting route. A quarterly tabletop exercise tests the 24-hour sequence.
• Management: The managing directors attend training, receive a report on the status of the measures every six months and record this in minutes.

What this page does not settle

Whether your company is an important or particularly important entity, how to count employees and turnover in a group of companies and which obligations apply to you in detail depends on the specific facts and needs a legal assessment. We support the technical implementation; we do not provide legal advice. We checked the legal position on 1 November 2026; check the current position before making decisions.