BSI C5 and ISO 27001: differences and the path from certificate to attestation

A customer asks for a C5 attestation for the first time, and your company is ISO 27001 certified. This page explains which parts of your information security management system (ISMS) you can reuse, what the C5:2026 criteria catalogue adds on top, and how to start a first mapping. BSI C5 is the German Federal Office for Information Security’s criteria catalogue for cloud services.

How does C5 differ from ISO 27001?

ISO 27001 certifies a management system; C5 attests a specific cloud service. Every C5 engagement follows ISAE 3000 (Revised) or a national equivalent such as the German IDW PS 860, always with reasonable assurance (sections 3.2 and 3.4.1). What an attestation says and why it is not a certificate is explained on C5 attestation.

What you can reuse from ISO 27001

The ISMS itself is the main asset. Basic subcriterion OIS-01.01B reads: “The cloud service provider maintains an ISO/IEC 27001-compliant information security management system (ISMS).” OIS-01.02B asks for documents you know from certification, including the scope (clause 4.3), the statement of applicability (6.1.3) and the management review (9.3). The 17 C5 areas are also grouped according to the structure of ISO/IEC 27001:2013 Annex A, while the content of the criteria considers the 2022 edition (section 2.2).

The BSI FAQ states that all requirements of ISO/IEC 27001 are also contained in C5. In practice, a well-run ISMS process can almost always be mapped to a C5 criterion. Typical candidates:

• security policy and policy management (OIS-02, SP-01 to SP-03),
• risk assessment and risk treatment (OIS-07 to OIS-09),
• roles, segregation of duties and awareness (OIS-04, HR-03),
• internal ISMS audits and management assessment (COM-03, COM-04),
• supplier and service organisation management (SSO-01 to SSO-05),
• incident handling and business continuity (SIM-01 to SIM-06, BCM-01 to BCM-04).

The audits can be combined, too. The FAQ notes that the same audit team can test other standards such as ISO/IEC 27001 alongside C5, and the catalogue recommends aligning other audits with the C5 engagement (section 3.3).

OIS-01: does your ISO certificate settle the first criterion?

You do not need a certificate for the basic criterion. The supplementary information to OIS-01 says: “The basic criterion can also be fulfilled without valid certification of the ISMS according to ISO/IEC 27001 or ISO 27001 based on BSI IT-Grundschutz, if the submitted documentation meets the requirements of ISO/IEC 27001.”

• OIS-01.01AS (a sharpening subcriterion, which replaces and raises a basic one) requires a valid certification according to ISO/IEC 27001 or ISO 27001 based on IT-Grundschutz whose scope covers the cloud service. A sharpening subcriterion replaces the basic subcriterion it sharpens (section 2.1).
• OIS-01.01AC (complementing) requires certificates to be issued by an accredited certification body.

You decide which additional criteria go into the audit scope and explain the selection in the system description (section 3.4.3). Our view: if your certificate already covers the service, adding OIS-01.01AS costs little and shows customers that the ISMS is externally confirmed. If it only covers headquarters or another product, check first whether the scope can be extended. For Section 393 SGB V (Book V of the German Social Code) in German healthcare, the wording asks for an attestation of the basic criteria only.

What ISO 27001 does not cover

The largest gaps concern the type of audit and transparency towards customers:

1. Operating effectiveness over a period. A Type 2 report assesses whether controls operated effectively over a period; the catalogue says the period should cover three to twelve months (section 3.4.4, Attestation Engagement). You need evidence that builds up across the whole period. Choosing the report type is covered on C5 Type 1 or Type 2.
2. System description and management statement. In an attestation engagement the auditor examines your description of the service, with eight minimum content items, and a management statement (sections 3.4.5.1 and 3.4.5.2). An ISMS manual does not meet this on its own; see C5 system description.
3. General conditions GC-01 to GC-06. Information on applicable law and locations, availability, recovery, government investigation requests and existing certifications or attestations (section 4).
4. Customers and subservice organisations. The description lists the complementary user entity controls (CUEC) you assume and the services provided by subservice organisations, with company name, processing location and monitoring. Software running on another provider’s platform generally makes that provider a subservice organisation (section 3.4.6).
5. Cloud-specific criteria. C5:2026 adds criteria on container management, supply chain, post-quantum cryptography and confidential computing, and treats multi-tenancy and sovereignty in more detail, for example PSS-12 on the region of data processing (section 1.1). Sovereignty requirements beyond C5 are set out in the BSI’s C3A criteria. The areas product safety and security (PSS) and investigation requests (INQ) come on top.
6. Stricter consequences of single gaps. A criterion counts as not met as soon as one of its subcriteria is not met, and deviations are reported even if the criterion was achieved overall (sections 3.4.12 and 3.4.13).

Exclusions work differently as well: unlike in a statement of applicability, a C5 criterion can never be excluded because controls are missing or not effective (section 3.4.3). Review every planned exclusion again; the justifications the catalogue accepts are explained on C5 system description.

Why the auditor does not simply take over ISO audit results

The catalogue is explicit: “results from ISO certification audits are to be assessed differently from those obtained from an ISAE 3000 audit” (section 3.3). The BSI FAQ adds that existing certificates are generally not recognised in the attestation audit, for instance because the effectiveness of measures in the past was not tested. The auditor signs and is liable for the attestation, so they may draw on other reports to a limited extent but will usually perform their own testing. A certificate therefore does not lead to an attestation automatically; its value lies in mature processes and existing documentation.

Is there an official mapping between C5:2026 and ISO 27001?

Not yet. The BSI has announced a cross-reference table between C5:2026 and international standards; on 1 November 2026 it was not listed for download on the C5:2026 page. Tables exist for C5:2020. Even an official table only shows thematic proximity; the catalogue states that actual fulfilment cannot be concluded “solely from the mapping given in the cross-reference table” (section 3.3).

Example mapping (our own, not official)

The table below is our own mapping of selected C5:2026 criteria to ISO/IEC 27001:2022 by title and topic. It is not an official cross-reference, does not reproduce text from the standard and does not replace a detailed review.

An entry in the third column only means the topic appears in the standard. Whether your controls meet every subcriterion of the C5 criterion is a separate question.

What about the German C5 Equivalence Ordinance?

German healthcare has its own route via ISO 27001. The C5 Equivalence Ordinance (C5GleichwV) accepts, among others, an ISO 27001 certificate for Section 393 SGB V if a remediation plan for the cloud service is in place. The ordinance sets out four required parts of the plan and deadlines counted from the date of the milestone plan; whether it applies to your service needs a legal assessment.

Example: an HR and payroll SaaS provider with ISO 27001 heading for C5

Fictitious example, not a real client. A provider of HR and payroll software is certified to ISO/IEC 27001, with development and operations in scope. The software runs on a large cloud platform. An insurance group requires a C5 attestation in its tender.

1. Scope: the service is inside the certificate scope, so OIS-01.01AS can be added to the audit.
2. Statement of applicability against C5: policies, risk management, supplier management and internal audits map well, but evidence must exist for a whole Type 2 period.
3. Gaps: no system description, no GC-01 to GC-06 information, no list of complementary user entity controls (CUEC), no disclosures about the platform provider as a subservice organisation, no procedure for investigation requests (INQ).
4. Exclusions: IaaS-only criteria are excluded with a reason based on the nature of the service; everything else stays in scope even where controls are still missing.
5. Timing: a Type 1 report is not required before Type 2 (section 3.4.11). C5:2026 applies to specified dates and periods starting on or after 1 June 2027; earlier adoption is permitted. Backward planning to the customer deadline is shown on C5 audit process.

How we support the move from ISO 27001 to C5

In a C5 gap analysis we compare your ISMS with the 168 criteria and the general conditions of C5:2026 and show what you reuse, what you adapt and what you build new. Blackfort Technology does not issue attestations; an independent auditor does. We support you until you are ready for the audit; book an initial call to discuss your starting point. If you also hold a SOC 2 report, see C5 vs SOC 2.