BSI C5 Type 1 or Type 2: which report to commission first

This page helps you choose the report type for a BSI C5 attestation. What a C5 attestation tells customers overall and how the audit runs are covered on separate pages.

What do Type 1 and Type 2 assess?

A Type 1 report assesses whether controls are suitably designed to meet the applicable C5 criteria as of a specified date. A Type 2 report assesses the design and also the operating effectiveness of the controls throughout a specified period (catalogue, section 3.4.4).

For customers, the difference is practical. A Type 1 report shows that the controls are set up correctly. A Type 2 report shows that they actually ran for months, for example that access rights were reviewed and backups were tested.

Do I need a Type 1 report before Type 2?

No. The catalogue states that a Type 1 report is not required before a Type 2 report is mandated (section 3.4.11). An initial engagement can be a Type 2 engagement straight away.

The reverse also holds: Type 1 is for the initial engagement only, and all subsequent engagements are Type 2 (section 3.4.4). Engagements that only assess design must not be performed on a recurring basis (section 3.4.1). If you start with Type 1, your next engagement will be Type 2 regardless.

For initial engagements, the catalogue allows some flexibility for controls that have not fully run yet (section 3.4.11). Where an activity is not yet complete, such as a business impact analysis across all units or a disaster recovery test, planning records or documentation templates can serve as evidence. Where a control is not yet live in production, a non-production environment configured like production can be used.

When does Type 1 make sense, and when should you go straight to Type 2?

Start from your customers’ requirement: if they require Type 2, Type 1 is only an interim step. The overview below is our assessment, not a requirement of the catalogue:

German healthcare: Section 393 SGB V (Book V of the German Social Code) sets dates for when a Type 1 attestation is sufficient and when Type 2 is required, since 1 January 2026 including an 18-month rule for systems first placed on the market after 30 June 2025 (Federal Law Gazette 2025 I No. 371). Details and the legal context are on Section 393 SGB V.

How long is the Type 2 period?

The period should cover at least three and no more than twelve months (section 3.4.4). The catalogue explains the lower limit: for shorter periods, the auditor cannot obtain sufficient evidence of operating effectiveness (section 3.4.11). Periods beyond twelve months are for exceptional cases, for example to align with other audits, and the management statement must then state the reason (section 3.4.5.2). In general, the catalogue recommends keeping the period consistent.

Columns two and three are our assessment. According to the BSI FAQ, a provider that wants continuous C5 coverage needs one to four audits a year, depending on the period chosen.

For Type 2, the catalogue requires additional content in the system description: significant changes to the system of internal control during the period and significant events, such as missed availability commitments, unauthorised access to customer data or ineffective safeguards, together with the measures taken (section 3.4.5.1).

Which catalogue revision applies depends on when the period begins: periods beginning on or after 1 June 2027 are audited against C5:2026, while a period that begins before that date and ends after it should cover the C5:2020 criteria only (section 3.5). For Type 1, the specified date counts.

What the report type means for your deadline

A Type 2 report can only be completed after the period ends, and the period should last at least three months. Our recommendation: have the controls operating when the period starts, otherwise there is no evidence of operating effectiveness for the first weeks; for a first engagement, section 3.4.11 allows alternative evidence (see above). A Type 1 report needs no period and can therefore be available sooner. How to work back from your customer’s deadline is shown in the backward planning with a worked example.

Example: a customer requires a Type 2 report

Fictitious example, not a client. A provider of HR management software as a service holds an ISO 27001 certificate. A new customer, a regional bank, requires a C5 Type 2 report in its contract and accepts a Type 1 report for the first months. The provider weighs two routes:

• Route A, Type 1 first: a Type 1 report as of a specified date meets the customer’s interim requirement. A Type 2 engagement follows in any case, so the provider commissions two engagements.
• Route B, straight to Type 2: the provider starts a three-month period as soon as the controls run. Only one engagement is needed, but the first report arrives only after the period ends and the report is written.

The question is whether route B meets the customer’s deadline. If it does, it saves an engagement; if not, route A bridges the time.