Evaluating a C5 report as a customer: period, deviations, your own duties

This page is for customers of cloud services: procurement, information security, data protection and internal audit in companies, public authorities and healthcare organisations. What a C5 report contains and what it says in principle is explained on C5 attestation. Here the focus is on evaluating it for your own decision.

Before you read: request the report and define the purpose

You get the report from the provider. According to the BSI FAQ it belongs to the provider, and customers have no general right to it. A contract can provide otherwise. The FAQ does, however, call it the purpose of C5 that customers can see the full report, and so passing it on is usually in the provider’s interest. Expect a non-disclosure agreement. The report also refers to a liability agreement of the auditor (section 3.4.13, item 1.8). Read it before you pass the report on internally.

The BSI does not review C5 reports and does not supervise C5 audits (BSI FAQ). The assessment is yours. The catalogue names as intended users of the report customers and prospective customers, their independent auditors and regulators who have sufficient knowledge of, among other things, the service, internal control systems and the role of customer controls (section 3.4.13, item 1.7). Before you read, note what you need the report for: selecting a new provider, the annual monitoring of an existing one, evidence for a supervisory authority. That decides how deep you go.

Step 1: Is it a C5 report?

Not every report that mentions C5 is an audit under C5. The BSI FAQ points out that you cannot tell just by looking whether an ISAE 3000 audit was only “based on” C5 or complied with all C5 criteria. Look for these features from the catalogue:

• an audit with reasonable assurance under ISAE 3000 (Revised), IDW PS 860 or a national equivalent (sections 3.2 and 3.4.1),
• the catalogue revision audited against, C5:2020 or C5:2026; C5:2026 applies to type 1 dates on or after 1 June 2027 and to type 2 periods beginning on or after that date,
• at least all basic criteria in scope; excluded criteria with a justification,
• a section on independence and quality management confirming the qualification of the engagement team (section 3.4.2),
• test procedures described for each criterion, in a type 1 report too (section 3.4.13, item 4).

The FAQ lists further indicators that can be checked quickly. Some of them are not in the catalogue in this form, such as the signature of a Wirtschaftsprüfer (German public auditor): the catalogue also provides for auditors who are not public auditors, provided they name equivalent professional requirements. The details are on Choosing a C5 auditor.

Step 2: Service, regions, type and period

According to the BSI FAQ, a C5 attestation only covers the audited cloud services in the specified regions, never the provider as a whole. Check three things against your own use:

Check the gap between the end of the period and today. According to the BSI FAQ, C5 audits are usually repeated annually, and customers typically have it agreed in the contract that they receive all subsequent reports. Our recommendation: for the time since the end of the period, ask for written confirmation that no significant changes have occurred, and for the planned end of the next period. Such a confirmation is a statement by the provider and has not been audited.

Step 3: The audit opinion

The opinion is in the auditor’s report. It can be unqualified, qualified or adverse. Under section 3.4.12 it has to be modified, for example, if the system description does not fairly present the system, if criteria were not fully met by controls, if controls were not suitably designed or, in type 2, did not operate effectively, or if the auditor was unable to obtain sufficient evidence. The reasons are then set out in a section of their own.

According to the BSI FAQ, an unqualified opinion expressly does not mean there were no deviations. If in the auditor’s view there are only minor deviations, the opinion can still be unqualified. The FAQ concludes from this that C5 reports have to be evaluated. So always read on to the results for each criterion.

Step 4: Evaluating deviations

You find deviations in the part with the controls, test procedures and results. If it says more than “No deviation noted”, the auditor has to state the extent of testing, where sampling was used the sample size, and the number and nature of the deviations (section 3.4.13, item 4). Deviations have to be reported even if the auditor concludes the criterion was met overall. A criterion is not met as soon as one of its subcriteria is not met (section 3.4.12).

For each deviation, the provider adds information in a separate section, for example “Other Information Provided by the Cloud Service Provider”: whether and when it detected the deviation itself, whether it was already stated in a previous report and why it has not yet been remedied, and which actions are planned and by when. This information is not subject to the audit, and the auditor does not express a conclusion on it.

Our recommendation for assessing each deviation, in four questions:

1. Does it affect my use? A deviation in the physical security of a data centre that does not serve your region weighs differently from one in revoking access for administrators of your tenant.
2. How large is it? Number of deviations relative to the sample; a single case or a pattern across the period.
3. Is it recurring? A reference to a previous report shows that a deviation was already found once and has not yet been remedied effectively.
4. What follows for me? No consequence, a countermeasure of your own, a follow-up question to the provider with a deadline, or a reservation in your decision.

Pay attention to the nature of the test. The catalogue requires the auditor to name it, such as inquiry, observation, inspection or reperformance, and to describe whether all items or a sample were tested. This shows you what a result is based on.

Step 5: Your own duties from the report

The system description lists the complementary customer controls (also called complementary user entity controls, CUEC) the provider assumes you perform, and the auditor’s report makes clear that the criteria can only be met if you implement these controls. The auditor has not tested them (section 3.4.13, item 1.1). Take each CUEC into your own control system as a task with an owner. How provider and customers record these duties in a responsibility matrix is shown on Complementary customer criteria.

Step 6: Subservice organisations

The auditor’s report states which services subservice organisations perform and whether they were included under the inclusive method or carved out under the carve-out method. With carve-out, the audit does not extend to their controls, and the criteria are only met if the controls assumed at the subservice organisation are effective. In that case, ask for the reports of the most important subservice organisations, such as the cloud platform. The system description gives the company name, the location of processing and storage at country level and the availability of their own C5 reports. How a provider itself evaluates its subservice organisations’ reports is covered on Subservice organisation inventory.

Step 7: General conditions and significant events

The information on the general conditions GC-01 to GC-06 is meant to help customers assess whether the service suits their own use case (section 4). For customers these points are particularly useful:

• GC-01: applicable law, jurisdiction, countries, regions and locations, including the country of the ultimate parent company,
• GC-02 and GC-03: availability and incident handling in regular operation, recovery parameters in emergency operation; compare them with your contract,
• GC-05: handling of investigation requests from government agencies, including the number of requests and the countries they come from,
• GC-06: existing certifications and attestations; GC-06 does not require certificates, only transparency about existing ones.

A type 2 report adds the significant events during the period, such as failures to meet contractual availability or unauthorised third-party access to customer data, together with the countermeasures taken. If you have higher protection needs, also check which additional criteria the provider has included. The basic criteria describe the minimum level for normal protection needs (section 2.1).

The evaluation record

Record the result in a short evaluation record that you update at the next evaluation. The BSI provides an evaluation guideline for this. The FAQ currently refers to documents for C5:2020, with an update for C5:2026 announced (retrieved 1 November 2026). Our record is a template of our own with these fields:

Some customers have their own requirements for the evaluation. For German federal authorities, the BSI minimum standard for the use of external cloud services (Mindeststandard des BSI zur Nutzung externer Cloud-Dienste) applies (section 3.1 of the catalogue). Healthcare providers will find a checklist tailored to Section 393 SGB V on Section 393 SGB V. What customers subject to NIS2 and DORA ask in addition is covered on C5 and NIS2 and C5 and DORA.

Example: a city administration reviews the report for an appointment booking service

Fictitious example, not a client. A city administration wants to outsource online appointment booking for its citizens’ offices to a SaaS service and receives a C5 type 2 report from the provider under a non-disclosure agreement. The record in short: