TR-03161 and C5 attestation: two audits, one coordinated evidence path

Manufacturers of digital health applications come across two BSI documents that sound as if they deal with similar topics and yet audit different things. This page places Technical Guideline TR-03161 alongside C5, explains the interface via the backend system and sets out an order of work for the evidence. What a C5 attestation says in general is covered on C5 attestation.

What is BSI TR-03161 and when is it required?

TR-03161 “Anforderungen an Anwendungen im Gesundheitswesen” (requirements for healthcare applications) is a family of three Technical Guidelines of the BSI for manufacturers of healthcare applications. Status on the BSI website as of 1 November 2026:

It is required above all for digital health applications (Digitale Gesundheitsanwendungen, DiGA) and digital nursing applications (Digitale Pflegeanwendungen, DiPA). Under Section 139e(10) SGB V (Book V of the German Social Code), the BSI sets the data security requirements to be demonstrated, and the manufacturer must provide this evidence “no later than 1 January 2025 by presenting a certificate” (our translation). On its page on data security criteria, the Federal Institute for Drugs and Medical Devices (Bundesinstitut für Arzneimittel und Medizinprodukte, BfArM) names exactly these three parts as the guidelines for the certificate and makes the certificate a prerequisite for listing in the directory, with transitional rules for which the BSI refers to the BfArM. How this affects your application needs to be assessed case by case. Whether DiGA and DiPA manufacturers also need a C5 attestation of their own (C5 for DiGA and DiPA) is covered in the section “When does the manufacturer need its own C5 attestation?” below.

Which parts are audited depends, according to the BSI’s FAQ on TR-03161, on how the application is built: an app is audited against Part 1; if it has a backend system, Part 3 is added, and if there is a web front end or security-relevant functions via a web interface, such as administrative access, Part 2 as well.

What does TR-03161 audit, and what does C5 audit?

TR-03161 assesses a product in a specific version, C5 the control system of a cloud service at a point in time or over a period. This leads to different auditors, results and periods of validity:

A TR-03161 certificate therefore does not replace a C5 attestation, and a C5 attestation does not replace TR-03161 certification. They audit different subjects under different procedures.

Where does TR-03161 require a C5 attestation?

In Part 3 for backend systems, test aspect (10) “Organisatorische Sicherheit” (organisational security). Two requirements concern operations:

• O.Org_1: The operator of the backend systems must demonstrate certification under ISO 27001, on the basis of IT-Grundschutz or under a comparable standard.
• O.Org_2: If the backend system is implemented wholly or partly as a cloud solution, “the cloud service provider MUST, over the entire period of use, hold a type 2 C5 attestation or a comparable attestation or certificate for the cloud services used from the region used” (our translation). If the attestation lists deviations or defects, the provider of the backend system must analyse the resulting risks and respond appropriately (TR-03161-3, section 3.1.10).

The testing body checks this according to the test characteristic for O.Org_2: it checks whether the cloud service provider holds a corresponding C5 attestation and, where the attestation shows defects or anomalies, whether they affect the backend system; such points belong in the risk analysis. According to the guideline, whether another attestation or certificate counts as comparable can be clarified by enquiring with the BSI. In its FAQ on TR-03161, the BSI states that, according to the cross-reference table, no combination of other certificates meets the requirements of C5. Clarify any evidence other than C5 with the testing body before the audit.

Two points in the wording matter for planning. First, O.Org_2 requires the attestation of the cloud service provider: if you run your backend system on a third-party IaaS or PaaS platform, this is usually the platform’s report, for exactly the services and the region you use. How to check what a platform attestation covers for your service is explained on C5 scope. Second, “over the entire period of use” means that the platform’s report periods should follow one another without gaps. For certification, the testing body checks the attestation available at the time; you still need the follow-up reports afterwards.

When does the manufacturer need its own C5 attestation?

TR-03161 requires a C5 attestation from the cloud service provider, not from the manufacturer of the application. An attestation of your own can become necessary for another reason: if the manufacturer runs its backend system itself as a cloud service for customers to whom Section 393 SGB V applies, such as medical practices, hospitals or health insurers that view data through a portal. The law then makes processing subject to, among other things, a current C5 attestation for the basic criteria; instead of the attestation, the C5 Equivalence Ordinance (C5GleichwV) accepts other evidence with a remediation plan under certain conditions. Whether Section 393 applies to your service depends on who processes the data and on whose behalf; that needs a legal assessment of the individual case. If both apply, you have two audits with different subjects: TR-03161 for the application, C5 for the cloud service you provide to your customers. What this means in detail for DiGA and DiPA manufacturers is covered on C5 for DiGA and DiPA.

Where the topics overlap

In terms of content, several test aspects of TR-03161-3 touch on C5 domains. The following mapping is our thematic classification, meant as a planning aid. It does not mean that one audit fulfils the other; the catalogue itself says of its own cross-reference that fulfilment cannot be derived from a mapping alone (section 3.3). The wording of both documents is binding.

Coordinating evidence for both audits

We recommend an order of six steps. It prevents the same question from being answered twice with different answers.

1. Delimit the components. A list of all components of the application with two columns: which part of TR-03161 covers it and whether it belongs to the scope of a C5 service, your own or the platform’s.
2. Obtain and evaluate platform reports. For O.Org_2 you need the cloud service provider’s C5 report for the services used and the region. Evaluate it once, looking at deviations that affect your backend system and at the complementary customer controls (also called complementary user entity controls, CUEC) the cloud service provider expects from you. The record serves the TR risk analysis and, if you are attested yourself, the monitoring of your subservice organisations. How to evaluate a report is covered on Reading a C5 report.
3. Settle the ISMS evidence. O.Org_1 requires a certificate for the operator of the backend systems. If you have one, check whether its scope covers the operation of the backend system.
4. Plan releases. The TR certificate applies to the audited version. Define which changes trigger re-certification or a maintenance procedure, and link this to your change management, which a C5 auditor will want to see under DEV anyway.
5. Keep one evidence register. Add a “TR test aspect” column to your evidence register. That way you see which evidence applies to which audit and which version or period it relates to.
6. Keep an eye on the catalogue version. In their bibliographies, the three TR parts refer to the 2020 version of C5. For audits with type 2 periods beginning on or after 1 June 2027, C5:2026 applies. Whether a testing body accepts a platform report under C5:2026 without further ado is a question for the testing body; the wording of the TR does not answer it.

Example: a prevention app commissioned by a health insurer

Fictitious example, not a client. A software company develops and runs a back health prevention app for a health insurer. The app is not a DiGA; the health insurer requires a TR-03161 certificate in the contract. The application consists of the app for insured persons, a web portal in which the insurer’s staff view participation and reports, and a backend system on an IaaS platform in a German region. The software company is certified under ISO 27001.

Outcome of the example: TR certification can start once the platform report has been evaluated and the ISO scope adjusted. Whether the software company also needs C5 evidence of its own depends on the legal assessment of Section 393; if it turns out that way, a C5 readiness assessment clarifies the route there.