# Outline of a C5 system description

Template: Blackfort Technology, CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/), https://c5-readiness.de/en/c5-templates. When sharing the template, please credit the source, link to the licence and indicate your changes. In completed documents you use as your own, you may omit the attribution; to that extent we as licensor waive it (does not apply to the catalogue references). Own outline with own headings, no warranty; it does not replace the catalogue. Criteria IDs serve as references; section and criteria titles are taken verbatim from © Federal Office for Information Security 2026, Cloud Computing Compliance Criteria Catalogue C5:2026, version 1.0.1 (https://www.bsi.bund.de/C5) and are licensed under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/), share them only unchanged and with this notice; the template contains no criteria texts. Everything else is our own work under CC BY 4.0. The Blackfort logo and the name Blackfort Technology are excluded from the licence; replace the logo and sender details with your own before you share a completed document. The minimum content items in section 3.4.5.1 of the C5:2026 criteria catalogue (BSI, version 1.0.1, https://www.bsi.bund.de/C5) are authoritative. Short instructions: https://c5-readiness.de/en/c5-templates#system-description-outline, minimum content in detail: https://c5-readiness.de/en/c5-system-description

Numbers in brackets refer to the list in section 3.4.5.1.

## 0. Preliminary notes
- Purpose of the document, report type (Type 1 with a specified date or Type 2 with a period), catalogue revision
- Method for subservice organisations (carve-out or inclusive)

## 1. The cloud service (no. 1)
- Name, service model, scope of service, editions
- What is not part of the service

## 2. System components (no. 2)
- Architecture overview with diagram
- Infrastructure, platform, software, data storage, networks
- People and processes operating the service

## 3. General conditions of the service (no. 3)
- Information on GC-01 to GC-06, one subsection each

## 4. Applicable criteria (no. 4)
- Table of all criteria IDs marked applicable/not applicable
- Justification for each criterion that is not applicable (nature and design of the service or the provider's principles, procedures and measures, section 3.4.3)
- Selected additional criteria and rationale for the selection

## 5. System of internal control (no. 5)
- Control environment: organisation, roles, policies
- Risk assessment
- Control activities per area, mapped to criteria IDs
- Information and communication
- Monitoring activities

## 6. Exceptions to normal operation (no. 6)
- Handling of security incidents and failures of system components

## 7. Complementary user entity controls, CUEC (no. 7)
- List of customer controls with criteria ID (from the responsibility matrix)

## 8. Subservice organisations (no. 8)
- Per subservice organisation: company name, location of processing and storage, assessment of complexity and dependency, available C5 reports (from the subservice inventory)
- Controls assumed at the subservice organisation (CSOC)
- How the provider monitors subservice organisations

## 9. Type 2 only
- Significant changes to the system of internal control during the period
- Significant events during the period and measures taken, without revealing points of attack

## 10. Transition to C5:2026 only
- Planned changes to controls if the period ends on or after 28 February 2027: criteria ID, nature of the change, implementation status, implementation date