Where to start
C5 readiness assessment for cloud and SaaS providers
A C5 readiness assessment, or gap analysis, shows how far your service is from a BSI C5 attestation and what has to happen before your deadline. You get a prioritised action plan and a timeline that starts from the report type and the audit period.
What a C5 gap analysis answers
Three questions come before any C5 project: what exactly will be audited, how much of it you can already evidence, and which report is realistic by your deadline. The gap analysis answers them for your service before you engage an auditor or fix a budget.
The basis is the BSI C5:2026 catalogue with 168 criteria in 17 areas. The basic criteria define the minimum scope of every audit; additional criteria are chosen by the provider, who has to explain the selection. A criterion can only be excluded with a justification under section 3.4.3, never because the control is missing or ineffective; how this goes into the description is shown on the C5 system description page.
An ISO 27001 certificate or a SOC 2 report gives you a lot to build on, but neither is enough for a C5 attestation on its own. The catalogue itself says that results from ISO certification audits are to be assessed differently from those of an ISAE 3000 audit. The gap analysis shows what you can reuse and what has to be created.
Results of the gap analysis
You may use the results within your company without time limit; the details are set out in the proposal. They are built so that your team or another consultant can continue working with them.
01
Scope sheet
Service, regions, report type, catalogue revision, additional criteria and service organisations on two pages, agreed with your management.
02
Rating per criterion
A table of all applicable criteria with rating, a short justification and a reference to the existing evidence.
03
Prioritised action plan
Actions with priority, dependencies, owners and effort class. Anything that blocks the start of the audit period comes first.
04
Timeline from the deadline back
When the controls have to be in place, when a Type 2 period can start and which catalogue revision then applies.
05
Recommended audit route
Type 1 or Type 2, and whether an attestation engagement or a direct engagement suits you, with the reasons and the impact on your schedule.
06
Results meeting
We walk you and your management through the results and answer questions.
Fictitious sample result
An extract from a rating. The example is made up and does not relate to any client: a SaaS provider of AI-assisted diagnostic reporting, running in containers on a public cloud platform in Germany, with an ISO 27001 certificate and aiming for a Type 2 report under C5:2026.
| Criterion | Finding | Rating | Priority | Action |
|---|---|---|---|---|
| OIS-01 (ISMS) | ISO 27001 certificate in place, its scope does not mention the AI service | partial | high | Extend and document the ISMS scope to cover the service |
| OPS-34 (container policy) | Kubernetes in production, no rules for the container lifecycle | missing | high | Write and introduce a policy for images, hardening, inventory and decommissioning |
| SSO-04 (list of service organisations) | External model API provider not recorded | missing | high | Create a subservice inventory, decide on carve-out or inclusive |
| SSO-05 (monitoring) | Platform’s C5 report available but not reviewed | partial | medium | Introduce an annual report review with a named owner |
| IAM-05 (access review) | Admin rights are reviewed, rights in the support tool are not | partial | medium | Extend the review to all systems in scope, evidence each quarter |
| DEV-13 (software components) | SBOM for the backend, not for the model containers | partial | medium | Add SBOM generation to the container build pipeline |
| PSS-12 (region) | Processing contractually in the EU, backup location not documented | partial | medium | Fix the backup region and evidence it contractually and technically |
| BCM-04 (continuity tests) | Recovery never tested | missing | high | Plan a continuity test and run it before the audit period starts |
| System description | SOC 2 description of a sister product exists, without general conditions (GC-01 to GC-06) and subservice organisations | partial | high | Adapt the description to the C5 minimum content items |
Fictitious, shortened example, not a client. Ratings and priorities are illustrative; a real analysis covers all applicable criteria. Criteria IDs per BSI C5:2026; names in brackets are our own short forms.
What we look at
Six building blocks, adapted to your service. With a narrow scope some are short; with a complex architecture, scope and service organisations take more time.
What is in scope?
Define the scope
Which service, which regions, which environments. An attestation covers the audited services in defined regions, never the provider as a whole. We record this in the scope sheet.
More on C5 scopeWhat is already there?
Review existing evidence
ISMS documentation, statement of applicability, policies, penetration tests, SOC 2 system description. Basic criterion OIS-01 requires an ISMS in line with ISO/IEC 27001; a certificate is not mandatory, but the documentation has to meet the standard.
C5 and ISO 27001Where are the gaps?
Rate the criteria
Every applicable criterion is rated: implemented, partial, missing, or not applicable with a justification. Since a criterion is not met if a single subcriterion is not met, we rate at subcriterion level.
Who runs what?
Service organisations and platform
If your service runs on another cloud provider’s platform, that provider is generally a subservice organisation. We work out whether it is excluded from your audit (carve-out method) or included (inclusive method), which reports exist and how you monitor your service organisations. Carve-out does not remove accountability.
What do customers have to do?
Complementary user entity controls (CUEC)
Which controls does your service rely on customers to perform, such as granting rights in their own tenant? The auditor does not test these complementary user entity controls (CUEC), only whether the system description presents them fairly.
Which report by when?
Route to the report type
Type 1 or straight to Type 2, specified date or period, C5:2020 or C5:2026. Type 1 is only intended for initial engagements and is not a prerequisite for Type 2; the Type 2 period should cover three to twelve months.
C5 Type 1 or Type 2How the gap analysis works
The steps are fixed; the effort depends on your service. Scope and time required are set out in writing after the initial call.
1
Initial call
Service, trigger, deadline and existing documents, by phone or video as you prefer. We then propose a scope.
2
Document review
ISMS documentation, architecture, contracts with service organisations, existing reports.
3
Interviews
Short sessions with operations, engineering and security owners to find gaps between documents and practice.
4
Rating and plan
Rate every applicable criterion, prioritise the actions and draw up the project plan back from the deadline.
5
Results meeting
Presentation of the results and a recommendation for the next steps.
How long the gap analysis takes depends on the scope, the number of service organisations and how complete your documents are. We therefore only give a fixed duration after the initial call.
Your contact
Christian Gebhardt · Founder and Managing Director, Blackfort Technology
Your contact is Christian Gebhardt, Founder and Managing Director. Who works on the project is set out in our proposal.
We usually reply to your enquiry within 1-2 working days.
If your customers are in German healthcare
Section 393 SGB V (Book V of the German Social Code) makes an up-to-date C5 attestation for the C5 basic criteria one of the conditions for processing health and social data in the cloud. For the gap analysis this means, in our view, that additional criteria are not needed for this provision but may still matter to your customers. Section 393(3) no. 3 also requires that the complementary customer criteria contained in the audit report are implemented. Which content of the report is meant needs a legal assessment. In any case, your customers benefit from a clear list of your complementary user entity controls (CUEC), linked to the catalogue’s complementary customer criteria.
The C5 Equivalence Ordinance (C5GleichwV) allows, under conditions, an ISO/IEC 27001 certificate, ISO 27001 based on IT-Grundschutz or the Cloud Controls Matrix 4.0 instead, combined with an action plan. Among other things, the plan has to identify the basic criteria that the standard does not cover in substance. The rating per criterion from the gap analysis is a basis for this. Whether and how these rules apply to your service needs a legal assessment in each case.
What we need from you
A contact person with an overview of the service, access to ISMS documentation, architecture documents and contracts with service organisations, and time for the interviews with operations and engineering. We do not need access to production systems or customer data for the gap analysis. We work in English or German.
How we rate
Every rating has a justification and points to the evidence it relies on.
implemented
Control described, in place and evidenced; for Type 2 also demonstrable over a period.
partial
Control exists but is incomplete, does not cover the whole scope or lacks evidence.
missing
No control addresses the criterion.
not applicable
The criterion does not apply for reasons permitted by section 3.4.3 (nature and design of the service, or your principles, procedures and measures); the justification later goes into the system description.
The rating is our assessment for your preparation. It does not replace the auditor’s opinion.
What the gap analysis is not
To set expectations:
- Not a pre-audit by an auditor and not an attestation. Blackfort Technology does not issue attestations; the report comes from an independent auditor.
- Not a technical security test. Penetration tests and vulnerability scans are evidence we review, not part of the analysis.
- No promise of an attestation, no legal advice and no review of data protection, NIS2 or DORA; on Section 393 SGB V and the C5 Equivalence Ordinance we provide general information only. The full list is on the BSI C5 consulting page.
We do not publish prices on this website. After the initial call you receive a proposal with a fixed scope.
Frequently asked questions
Is a gap analysis the same as a readiness assessment?+
Yes, for our purposes. Both describe the stocktake before a C5 project: where the service already meets the criteria, where it does not, and what that means for the plan and the deadline.
Is a gap analysis worth it if we already have ISO 27001?+
Especially then. The certificate covers many fundamentals; only a criterion-by-criterion comparison shows which C5 criteria your ISMS documentation already supports and where C5 asks for more.
We have a SOC 2 report. Does the gap analysis use it?+
Yes. The SOC 2 controls and system description are among the evidence we review. The analysis shows what carries over and what C5 adds, such as the general conditions GC-01 to GC-06 and the information on subservice organisations.
Can we take the rating straight to an auditor?+
You can share the results with an auditor, for example to request a proposal. The auditor forms their own view and is not bound by our assessment.
What happens after the gap analysis?+
You decide whether to implement the actions yourselves, with us or with someone else. The plan is written so that your team can implement it without us.
Read more
- BSI C5 consulting: audit readiness for cloud and SaaS providers
- C5 scope: service boundary, platform reports, carve-out
- C5 system description: minimum content, structure and example
- C5 vs ISO 27001: what you can reuse and what is missing
- C5 vs SOC 2: reusing your SOC 2 report for a BSI C5 attestation
- C5 Type 2 or Type 1 report: differences, period, choice
- BSI C5 audit process: steps, audit standards and timeline
- Free C5 templates: scope sheet, evidence register, CUEC matrix
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (PDF), in particular sections 3.4.3, 3.4.4, 3.4.6, 3.4.12 and 3.5, licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: C5 FAQ (German) (retrieved 2026-11-01)
- Section 393 SGB V (German) (retrieved 2026-11-01)
- C5 Equivalence Ordinance, C5GleichwV (German) (retrieved 2026-11-01)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).
Last updated: 2026-11-01
Get in touch
Request a gap analysis
Tell us briefly which service needs to be audited and by when a report is due. We usually reply within 1-2 working days; in the initial call, by phone or video, we agree the scope.