Defining the BSI C5 scope for a SaaS service

The scope determines what the auditor tests, what the report says and how useful it is to your customers. This page shows how to limit the scope to one service, what your cloud platform’s C5 report covers for you and when carve-out or inclusive is the right method. How to present the result is covered on C5 system description.

What goes into a C5 scope?

Six decisions, all of which end up in the system description and the report:

The scope always includes the processes relevant to developing and operating the service, such as HR, change management and risk management, because the subject matter is the system of internal control relevant to the development and operation of the cloud service (section 3.4.4).

Can I limit the scope to one service?

Yes. According to the BSI FAQ, a C5 attestation is always issued for the audited cloud services in the specified regions, never for the provider as a whole. You can start with the service your customers ask for. The FAQ also suggests covering several services in one attestation, since shared components are then tested once; with several similar products on the same platform this is worth comparing.

• Shared components are considered. Anything that contributes to delivering the service may, or must, be considered in the audit, such as a central directory or a shared pipeline, but only the service receives the attestation (BSI FAQ).
• Exclusions only with a permitted justification. It has to rest on the nature and design of the service or on your policies, procedures and measures, such as IaaS-only criteria for a SaaS service; missing or ineffective controls are never a reason (section 3.4.3).
• The scope has to match what customers buy. Customers are told to check first that the services they use are covered (BSI FAQ). A scope that leaves out the module they bought does not help sales.

For healthcare in Germany, Section 393 SGB V (Book V of the German Social Code) refers to an attestation for the cloud systems and technology used for the cloud service. Whether your scope meets this needs a legal assessment in each case; see Section 393 SGB V.

What does the AWS, Azure or STACKIT C5 report cover for my SaaS?

Your platform’s report covers the platform’s controls for its audited services and regions, not your service. The catalogue assumes that a service delivered on another provider’s infrastructure or platform generally creates a subservice organisation relationship, in particular for operations; for third-party data centres this applies especially to physical security (section 3.4.6). Microsoft’s own FAQ puts it this way: customers can use the Microsoft attestation as a foundation, “however, you need to achieve your own C5 attestation for components outside or built on top of these services”.

The right-hand column is our assessment. Which controls a platform report actually contains is only in the report itself, so read it before you decide on the scope: services, regions, report type, period, catalogue revision, deviations and the complementary user entity controls (CUEC) listed.

What the platform providers state

We only repeat what the providers say on their own pages (retrieved 1 November 2026). The current report, requested from the provider, is the only reliable source. Where a provider page does not state something, the table says so; that says nothing about the report itself.

Check every platform service you actually use against that list. A managed database or AI service missing from the platform report is an open point in your supplier management.

Carve-out or inclusive?

For each subservice organisation you choose a method and state it in the system description (section 3.4.6). A supplier is a subservice organisation if its service is relevant to customers' understanding and controls at the supplier (CSOC) are needed to meet the criteria; cleaning companies or advertising agencies typically are not (section 3.4.6).

Carve-out does not shift accountability. The catalogue wants to prevent the method from being used to neglect criteria; the provider “remains ultimately accountable” and monitors subservice organisations under SSO-05 (section 3.4.6). SSO-05 includes regular review of independent third-party reports and, for subservice organisations, checking their controls against the expected CSOC. For each one the description names the company, the country of processing and storage, and a justified rating of complexity and dependency. Keep these details in a separate register, a subservice inventory; a template is on templates.

Three SaaS examples

Fictitious examples, not clients. The same rules lead to different decisions depending on architecture.

Example 1: billing SaaS on a hyperscaler

Example 2: practice software in a colocation data centre

Example 3: small B2B SaaS on managed Kubernetes

Common scoping mistakes

The scope sheet is available as a template on templates. How the scope drives timing is explained on C5 audit process.