Cloud services for German federal, state and local government: what authorities expect from a C5 report

This page is for cloud service providers who supply, or want to supply, public authorities of the federal government (Bund), the federal states (Länder) or local government (Kommunen). What C5 is and when it is generally required is explained on the BSI C5 page; the BSI’s sovereignty criteria C3A are described on the C3A page. You will also meet authorities as bodies that request information about, or the disclosure of, customer data; how to handle such requests is shown in the INQ domain. This page is not legal advice; which rules apply to a particular authority needs to be checked case by case.

Where the C5 requirement at federal level comes from

Section 3.1 of the catalogue states: “For cloud service customer on the federal level of the German public sector, the ‘Mindeststandard des BSI zur Nutzung externer Cloud-Dienste’ is applicable.” In English, this is the BSI minimum standard for the use of external cloud services. The current version is version 2.1 of 15 December 2022. Under Section 44(1) of the BSI Act (BSI-Gesetz, BSIG), federal administration bodies (Einrichtungen der Bundesverwaltung) must meet the minimum standards. On its page on the minimum standard, the BSI points out that this legal basis has replaced the earlier basis in Section 8 BSIG since the NIS2 Implementation Act (NIS2UmsuCG, the name used on the BSI page) entered into force on 6 December 2025 (BSI page as of 1 November 2026).

The minimum standard is addressed to the authority, not to the provider. Its preliminary remarks define which bodies it addresses: the bodies under Section 8(1) BSIG as then in force, today the federal administration bodies under Section 44(1) BSIG. Its definition in section 1.1 covers cloud services provided by private-sector providers outside the federal public administration, and the storage and processing of official data. For providers, its requirements take effect through the tender and the contract. Two points on versions: the minimum standard still refers to C5:2020 and, for new versions, points to the catalogue’s transition periods. When C5:2026 applies is explained on the C5:2026 page.

What the authority must do and what the provider supplies

Federal states and local authorities

Under Section 44(1) BSIG, the minimum standard is binding only on federal administration bodies. It does not apply directly to the federal states and local authorities. Whether and in what form they require C5 evidence follows from their own rules and from the tender documents (Vergabeunterlagen); we have not found a uniform rule we could cite. On its page on the minimum standard, the BSI lists decision 2016/35 of the IT Planning Council (IT-Planungsrat) of 13 October 2016 as a further document. In it, the IT Planning Council recommends that its members apply the procedures and criteria set out in the annex when procuring cloud services. In no. 5, Annex 1 names the BSI’s then “Anforderungskatalog Cloud Computing - Kriterien zur Beurteilung der Informationssicherheit von Cloud-Diensten” (criteria for assessing the information security of cloud services), the first version of C5 from 2016, as one of two bases; alongside or instead of it (“und/oder”, and/or), recommendations for tendering, awarding and operating public contracts in the cloud. This is a recommendation to the members, not an obligation, and it refers to a version that has since been replaced by C5:2020 and C5:2026. Whether requests you receive from the federal states and local authorities require C5 is therefore something you see from the tender, not from the decision. Our recommendation: read the specification of services (Leistungsbeschreibung) in every tender for report type, additional criteria and period.

The example: a platform for funding applications

Fictitious example, not a customer. A provider runs a platform on which companies and associations submit funding applications and authorities process them. Its customers are two federal authorities and several local authorities, with one tenant per authority. The platform runs on a German cloud platform in a region in Germany, with backups in a second region in Germany. The applications contain personal data and trade secrets of the applicants; the minimum standard assigns such data to categories 2 and 1 of its data categorisation (NCD.2.1.03 f).

Decision 1: Plan audit periods without gaps

The authority must not have a gap in time between two pieces of evidence. In our view, this means for the provider: set type 2 periods so that the next one begins where the previous one ends. Type 1 is intended only for the initial audit and is not a prerequisite for type 2 (see type 1 or type 2). If you start with type 1, the first type 2 period should begin directly after the specified date. If a period falls into the change from C5:2020 to C5:2026, the rules in section 3.5 of the catalogue apply.

Decision 2: Which additional criteria go into the audit scope?

The basic criteria describe the minimum level for a normal protection need and the minimum scope of every audit. Under the minimum standard, the authority has to cover, transfer or accept further risks through additional requirements. A provider can anticipate this by having additional criteria audited for which it sees demand among its public-sector customers; it decides which ones itself, and the selection has to be justified in the system description (section 3.4.3). For the example platform, additional criteria on transparency about the subcontractors of service organisations (SSO-07.01AS) and on prior consent for access to customer data (IAM-07.03AS) could, in our assessment, be relevant. If you expect sovereignty requirements, see the C3A page.

Decision 3: Notify changes to subservice organisations in advance

The minimum standard requires the authority to have intended changes to contracts with subservice organisations notified without delay, if possible before implementation, in particular when contracts end or new ones are concluded. SSO-07.01B requires the provider to inform customers about the service organisations it uses and the type of data they process. Our recommendation: build a trigger into the process for new service organisations that informs public-sector customers before the contract is signed, and file the notifications as evidence. For what the inventory looks like, see subservice organisation inventory.

Decision 4: Audit rights on a shared platform

Federal authorities should have their own audit rights assured, which they can exercise themselves or through third parties on their behalf. On a multi-tenant platform, such an audit must not, in our view, give any insight into the data of other authorities. Define, therefore, how an audit by an authority works: what is answered in advance from the C5 report, which additional evidence is available and how tenant separation is maintained during an audit. You demonstrate the separation itself through the layer model under OPS-30 and the risk assessment under OPS-31, which is reviewed at least annually.

Decision 5: Exclude classified information explicitly or regulate it separately

The minimum standard treats classified information (Verschlusssachen) under the German Classified Information Instruction (Verschlusssachenanweisung) as a separate data category (category 3). In our view, a C5 attestation does not answer whether a service is suitable for classified information. If processing classified information is not intended, this should be stated in the contract and in the specification of services.

Evidence authorities can expect from the provider

Possible gaps at providers for the public sector