# C5 scope sheet

Template: Blackfort Technology, CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), https://c5-readiness.de/en/c5-templates. When sharing the template, please credit the source, link to the licence and indicate your changes. In completed documents you use as your own, you may omit the attribution; to that extent we as licensor waive it (does not apply to the catalogue references). Criteria IDs serve as references; section and criteria titles are taken verbatim from © Federal Office for Information Security 2026, Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (https://www.bsi.bund.de/C5) and are licensed under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/), share them only unchanged and with this notice; the template contains no criteria texts. Everything else is our own work under CC BY 4.0. The Blackfort logo and the name Blackfort Technology are excluded from the licence; replace the logo and sender details with your own before you share a completed document. No warranty; a completed sheet is not evidence of an attestation. Short instructions: https://c5-readiness.de/en/c5-templates#scope-sheet, background on scope: https://c5-readiness.de/en/c5-scope

Version of this sheet: YYYY-MM-DD, prepared by: ..., approved by: ...

## 1. Service

| Field | Entry |
|---|---|
| Name of the cloud service | |
| Service model (IaaS, PaaS, SaaS) | |
| Description in two sentences | |
| Versions or editions in scope | |
| Explicitly out of scope (services, modules, environments) | |
| Regions and locations in scope | |

## 2. Trigger and deadline

| Field | Entry |
|---|---|
| Who asks for the attestation (customer, tender, law) | |
| Date by which a report is needed | |
| Intended report type (Type 1, Type 2, open) | |
| Initial or subsequent engagement | |
| Planned specified date (Type 1) or period (Type 2) | |
| Catalogue revision (C5:2020 or C5:2026), reason | |

## 3. Criteria

| Field | Entry |
|---|---|
| Basic criteria: criteria IDs likely not applicable, with a justification based on the nature and design of the service or the provider's principles, procedures and measures (section 3.4.3; missing controls are not a reason) | |
| Additional criteria to be included (criteria IDs), with the rationale for the selection | |
| Further catalogues (e.g. AIC4), if wanted | |

## 4. Architecture and service organisations

| Field | Entry |
|---|---|
| Platform or data centre the service runs on | |
| Service organisations with access to customer data (list in the subservice inventory) | |
| Intended method per subservice organisation (carve-out or inclusive) | |
| C5 reports of subservice organisations available (type, period) | |
| Key customer controls the service assumes (list in the responsibility matrix) | |

## 5. Existing foundations

| Field | Entry |
|---|---|
| ISO/IEC 27001: certificate yes/no, scope, validity | |
| SOC 2 report: type, period, Trust Services Criteria | |
| Existing system description (standard, date) | |
| Other evidence (penetration test, continuity test, policies) | |

## 6. Organisation

| Field | Entry |
|---|---|
| Owner of the C5 project | |
| Signatory of the management statement | |
| Contact person for the auditor | |
| Open questions | |