Last updated: 2026-11-01
The terms are grouped by topic, not alphabetically: from the evidence through the catalogue and the system description to the legal framework. Abbreviations are given with the full term.
Evidence and audit
| Term | In brief | |
|---|---|---|
| C5 | The BSI’s Cloud Computing Compliance Criteria Catalogue (Kriterienkatalog Cloud Computing), currently C5:2026, in English in version 1.0.1 and in German in version 1.1.0. It describes minimum requirements for the information security of cloud services and how they are audited independently. | BSI C5 |
| C5 attestation (C5-Testat) | The report of an independent auditor on one or more cloud services, audited against C5. It applies to the audited services in specified regions, not to the provider as a whole. | C5 attestation |
| C5 certification | Common search term for the C5 attestation. According to the BSI FAQ, there is no certification procedure and no C5 certificate. | C5 attestation |
| Type 1 and type 2 | Type 1 assesses the suitability of the design of the controls as of a specified date, type 2 also their operating effectiveness over a period. Type 1 is only intended for an initial audit and is not a prerequisite for type 2. | Type 1 or type 2 |
| Audit period | The period on which a type 2 report gives its opinion; it should cover at least three and at most twelve months. | Type 1 or type 2 |
| Follow-up audit | Any audit after the first; follow-up audits are type 2. The catalogue sets no fixed cycle; according to the BSI FAQ, audits are usually repeated annually. | Follow-up audit |
| Attestation engagement and direct engagement | The two permitted types of engagement. In an attestation engagement, the auditor audits the provider’s system description and management statement; in a direct engagement, the auditor presents the system itself. | C5 audit process |
| Auditor | The independent party that audits and gives the opinion. The catalogue requires an audit with reasonable assurance and also provides for auditors who are not public auditors (Wirtschaftsprüfer); the BSI FAQ names only public auditors. | Choosing a C5 auditor |
| ISAE 3000 (Revised), IDW PS 860 | The assurance standards under which a C5 audit is performed; IDW PS 860 is the German counterpart to ISAE 3000. ISAE 3402 and IDW PS 951 n.F. are also to be taken into account. | Choosing a C5 auditor |
| Audit opinion | The auditor’s result: unqualified, qualified or adverse. According to the BSI FAQ, an unqualified opinion does not mean there were no deviations. | Reading a C5 report |
| Deviation | A finding where a control was not designed as described or did not operate effectively. Deviations are reported even if the criterion as a whole is considered met. | Reading a C5 report |
Structure of the catalogue
| Term | In brief | |
|---|---|---|
| Domain | One of the 17 areas of the catalogue, such as OIS, IAM, OPS or SSO, with 168 criteria in total. | C5 criteria catalogue |
| Criterion and subcriterion | A criterion describes a requirement, and subcriteria break it down into auditable parts. A criterion is not met if one of its subcriteria is not met. | C5 criteria catalogue |
| Basic criteria | The minimum level for information with normal protection requirements and the minimum scope of every audit. Section 393 SGB V (Book V of the German Social Code) refers to an attestation for the basic criteria; instead of the attestation, the C5 Equivalence Ordinance accepts other evidence with an action plan under certain conditions. | C5 criteria catalogue |
| Additional criteria, sharpening (AS) and complementing (AC) | Optional subcriteria for higher protection requirements. A sharpening subcriterion replaces the basic subcriterion it sharpens; a complementing one is added to the basic subcriteria. | C5 criteria catalogue |
| General conditions GC-01 to GC-06 | Information about the service that belongs in the system description, for example on law and locations, availability, requests from authorities and existing certificates. They are not among the 168 criteria. | C5 criteria catalogue |
| C5:2020 and C5:2026 | The previous and the current revision. C5:2026 applies to type 1 specified dates on or after 1 June 2027 and to type 2 periods beginning on or after that date; earlier adoption is permitted. | C5:2026 |
System description and report
| Term | In brief | |
|---|---|---|
| System description | The provider’s presentation of the system of internal control for the service, with eight items of minimum content under section 3.4.5.1. The subject matter of an attestation engagement. | C5 system description |
| Significant changes and events | Required content of a type 2 report on changes to the system of internal control and on events during the period, with the measures initiated. | Changes and events |
| Management statement | Management’s written statement that the description is fairly presented and the controls are suitably designed; the German version of the catalogue calls it “Erklärung der gesetzlichen Vertreter” (statement of the legal representatives). | Management statement |
| Complementary customer controls (CUEC) | The controls the provider assumes its customers perform (also called complementary user entity controls), item 7 of the minimum content of the system description. The auditor checks that they are fairly presented, not whether customers implement them. | Complementary customer criteria |
| Complementary customer criteria | A part of the catalogue for selected criteria with general, non-exhaustive notes on where customers have to contribute. Not the same as the CUEC. | Complementary customer criteria |
Scope and subservice organisations
| Term | In brief | |
|---|---|---|
| Scope | The scope of the audit: which services, regions, components and criteria are audited. | C5 scope |
| Subservice organisation (Subdienstleister) | A service provider whose service is relevant to customers’ understanding and at which the provider assumes controls. Third-party data centres and third-party cloud platforms usually count as such. | Subservice inventory |
| Complementary subservice organisation controls (CSOC) | The controls the provider assumes at a subservice organisation. In some places (PS-01.05B) the German version of the catalogue uses a second wording, “komplementäre Kontrollen der Subservice-Organisationen”; it means the same. | C5 scope |
| Carve-out and inclusive | The two methods for subservice organisations: under carve-out, their controls are excluded from the description and the audit; under inclusive, they are audited as well. | C5 scope |
| Platform attestation | The C5 attestation of a cloud platform on which an application runs. It covers the platform, not the application on it. | C5 scope |
Work products of the preparation
| Term | In brief | |
|---|---|---|
| Gap analysis | A comparison of a service’s current state against the applicable criteria, with a list of gaps and measures up to audit readiness. | C5 readiness assessment |
| Evidence register | A list of all evidence for the audit, each item with control, origin, owner and time reference. | Evidence register |
| Subservice inventory | The register of service providers with the information the system description requires on subservice organisations. | Subservice inventory |
| Responsibility matrix | A table that records for each criterion what the provider and the customer contribute and which CUEC apply. | Complementary customer criteria |
| Action plan (Maßnahmenplan) | Here: the plan that the C5GleichwV requires alongside an alternative certificate, with gaps identified, safeguards and milestones. For the order of measures across domains, see Prioritising measures. | C5GleichwV |
Legal framework and related standards
| Term | In brief | |
|---|---|---|
| Section 393 SGB V | The provision on the use of cloud services in German healthcare. Among other things, it makes processing conditional on a current C5 attestation for the basic criteria and on implementing the complementary customer criteria; instead of the attestation, the C5 Equivalence Ordinance accepts other evidence with an action plan under certain conditions. | Section 393 SGB V |
| Maintenance access (GeDIG draft) | A draft law that would introduce new rules on maintenance and support access in Section 393; not yet adopted (as of 1 November 2026). | Maintenance access |
| C5 Equivalence Ordinance (C5GleichwV) | The ordinance under which, for Section 393, a certificate under ISO/IEC 27001, ISO 27001 on the basis of IT-Grundschutz or Cloud Controls Matrix 4.0 with an action plan counts as equivalent. | C5GleichwV |
| Publication under Section 393(7) | The list of attested cloud systems that the Competence Centre for Interoperability in Healthcare (Kompetenzzentrum für Interoperabilität im Gesundheitswesen) publishes at the providers’ request. Not a complete directory. | Finding providers with an attestation |
| BSI TR-03161 | The BSI’s technical guideline for healthcare applications, with product certification; required for DiGA. For back-end systems in the cloud it requires a C5 type 2 attestation of the cloud provider. | TR-03161 and C5 |
| NIS2 | The EU cybersecurity Directive 2022/2555, transposed in Germany by the NIS2 Implementation Act (NIS2UmsuCG, the name used by the BSI) in the BSI Act (BSI-Gesetz). It places obligations on entities as a whole; a C5 attestation does not cover these obligations on its own. | C5 and NIS2 |
| DORA | The EU Regulation 2022/2554 on digital operational resilience in the financial sector. It places obligations on financial entities, reaches their cloud providers through contracts and puts critical ICT third-party service providers under EU-level oversight. | C5 and DORA |
| ISO/IEC 27001 | The international standard for information security management systems, with certification. An ISO certificate does not automatically lead to a C5 attestation. | C5 and ISO 27001 |
| SOC 2 | An audit report under the standards of the US professional body AICPA; parts of it can be reused for C5. | C5 and SOC 2 |
| AIC4 | A voluntary BSI catalogue for cloud services that use machine learning, designed as an extension of C5. | AIC4 |
| A5 | A BSI audit architecture for AI systems, a community draft as of 1 November 2026. | BSI A5 |
| C3A | A BSI catalogue for assessing whether a cloud service can be used in a self-determined way (sovereignty); it requires C5. | C3A |
| EUCS | The planned European certification scheme for cloud services; C5:2020 was the basis for the “Substantial” level. | EUCS |
Frequently asked questions
Why is it called an attestation and not a certificate?+
According to the BSI FAQ, there is no certification procedure for C5. The evidence is a report that an independent auditor prepares under ISAE 3000 (Revised) or an equivalent standard. The C5 attestation page explains the differences.
Are CUEC and complementary customer criteria the same thing?+
No. The complementary customer criteria are in the catalogue and are general. The provider writes the complementary customer controls (CUEC) for its service into the system description.
Which terms does the glossary use?+
Those of the English version 1.0.1 of the catalogue. Where customers use other words, such as “C5 certification”, the search term is listed with a pointer to the catalogue term.
Is a term missing?+
The glossary contains the terms that have their own explanation on this website. Terms from individual criteria are on the domain pages, which you can reach through the criteria catalogue.
Read more
- C5 criteria catalogue: structure, basic and additional criteria
- C5 attestation vs C5 certification: report and meaning
- C5 system description: minimum content, structure and example
- BSI C5 audit process: steps, audit standards and timeline
- C5 scope: service boundary, platform reports, carve-out
- C5 complementary customer criteria and CUEC explained
Sources
- BSI: Mindeststandard zur Nutzung externer Cloud-Dienste (minimum standard for the use of external cloud services, German; page using the name NIS2UmsuCG) (retrieved 2026-11-01)
- BSI: Kriterienkatalog Cloud Computing C5:2026, version 1.1.0 (PDF, German), licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (PDF), licensed under CC BY-ND 4.0 (retrieved 2026-11-01)
- BSI: C5 FAQ (German) (retrieved 2026-11-01)
This content provides general technical and organisational information and does not constitute legal advice (no legal services within the meaning of the German RDG).