BSI C5: what it is and how to get your attestation in 2026

If you run a cloud service used by German public sector bodies, healthcare organisations, or regulated enterprises, you've probably heard "BSI C5" come up in contract negotiations or customer security questionnaires. It might have felt like another box to tick. But the more you dig into it, the more you realise it's actually one of the more sensible cloud security frameworks out there, and increasingly unavoidable if you want to do business in Germany and across Europe.

This guide covers everything you need to know: what C5 is, who needs it, and a clear path to getting your attestation.

What is BSI C5?

C5 stands for Cloud Computing Compliance Criteria Catalogue. It was developed by Germany's Federal Office for Information Security (the Bundesamt für Sicherheit in der Informationstechnik, known as the BSI) and first published in 2016. The BSI published an updated version, C5:2026, in April 2026, adding new criteria for container management, post-quantum cryptography, and supply chain security.

Unlike ISO 27001, which certifies an organisation's information security management system more broadly, C5 is built specifically for cloud service providers. It sets a minimum security baseline for cloud computing and produces an attestation report under ISAE 3000, meaning an independent auditor formally attests whether your controls meet the criteria.

Two report types are available:

• Type 1: assesses whether your controls are suitably designed at a point in time
• Type 2: assesses both design and operating effectiveness over a period of at least six months (typically twelve)

Since July 2025, a Type 2 attestation is the regulatory baseline for cloud providers serving Germany's healthcare sector under §393 SGB V. Type 2 is also increasingly the contractual norm across other regulated industries.

Who actually needs BSI C5?

The short answer: any cloud provider that wants to sell to German government agencies, hospitals, insurers, or large regulated enterprises. That includes:

• SaaS and PaaS providers with German public-sector customers
• Cloud infrastructure providers serving regulated industries
• Healthcare technology companies processing patient data
• Financial services and fintech platforms with German or broader EU clients

C5 isn't legally mandated for every cloud provider, but it's become a de facto procurement requirement in Germany. According to a December 2025 RÖDL analysis, it's "establishing itself as a cross-industry standard", and with NIS2 alignment now baked into C5:2026, pressure is growing across Europe too. If you're working toward NIS2 compliance for your SaaS team, a C5 attestation covers a good deal of the same ground.

What C5 actually covers: the 17 control domains

The C5:2026 catalogue contains 121 mandatory controls spread across 17 domains. These aren't arbitrary, they map directly to the specific risks of running cloud infrastructure:

1. Organisation of information security
2. Security policies and procedures
3. Personnel (HR)
4. Asset management
5. Physical security
6. Operations
7. Identity and access management
8. Cryptography and key management
9. Communication security
10. Portability and interoperability
11. Development, procurement, and modification of systems
12. Supplier and subservice provider management
13. Security incident management
14. Business continuity management
15. Compliance
16. Handling investigation requests
17. Product safety and security

Two things make C5 stand out from generic security frameworks. First, it requires explicit transparency around data location and jurisdiction, you must disclose exactly where customer data sits and whether it's subject to foreign access laws. Second, it mandates disclosure of your supply chain dependencies and known systemic risks. That level of transparency is something ISO 27001 alone doesn't require.

How C5 maps to ISO 27001 and SOC 2

If you already hold ISO 27001 certification or a SOC 2 attestation, you're not starting from zero. C5's criteria were originally built from ISO 27001:2013 Annex A and share significant overlap with both frameworks.

The practical implication: ISO 27001-certified organisations typically need to bridge cloud-specific gaps, particularly around virtualisation security, multi-tenancy, and the transparency requirements. An experienced adviser can run a targeted gap analysis to identify exactly where you stand, rather than rebuilding everything from scratch. You can read more about the differences between ISO 27001 and SOC 2 to understand how these frameworks interact before adding C5 to the mix.

Your step-by-step path to C5 attestation

Step 1: Gap assessment

Before anything else, map your current controls against the 17 C5 domains. Be honest about what you have vs. what the catalogue requires. Pay particular attention to the cloud-specific requirements, data segregation, cryptographic key management, and subservice provider oversight, since these tend to produce the most gaps for organisations coming from an ISO 27001 baseline.

Step 2: Remediation

Fix the gaps. This phase typically takes 2 to 6 months depending on your maturity. Common remediation activities include:

• Documenting or updating security policies for each C5 domain
• Implementing or formalising role-based access controls and MFA
• Setting up formal supplier risk management processes
• Preparing the System Description that the auditor will use as the basis for testing

Step 3: Observation period

For a Type 2 attestation, your controls need to have been operating consistently for at least six months before the audit period ends. This is the phase most organisations underestimate, you can't rush it. Start the clock as soon as your controls are in place.

Step 4: Engage your auditor

C5 attestations must be conducted by an independent auditor qualified in IT security (CISA or CISM certification is standard). The auditor will review your System Description, test a sample of controls against evidence from the observation period, conduct interviews with key staff, and issue a formal attestation report.

Step 5: Annual renewal

C5 attestation reports aren't permanent. You'll need annual reviews, with full Type 2 re-attestation on a regular cycle. Build this into your compliance calendar from day one.

Typical timelines and effort

Here's a realistic picture, based on publicly available guidance from the BSI and audit practitioners:

• Preparation and remediation: 2 to 6 months
• Type 1 audit assessment: 2 to 4 weeks
• Type 2 observation period: minimum 6 months (usually 12)
• Auditor review and report: 4 to 8 weeks
• Total end-to-end for first Type 2 attestation: 9 to 18 months from a standing start

Organisations with a mature ISO 27001 ISMS can often compress the preparation phase significantly. Running a cybersecurity risk assessment early helps prioritise where to focus remediation effort.

Evidence your auditor will expect

Here's what you'll need to gather and maintain throughout the observation period:

• Security policies covering all 17 C5 domains
• Documented risk assessment records with evidence of management review
• Access management logs showing RBAC implementation, MFA enforcement, and periodic access reviews
• Incident response records including documented incidents, post-mortems, and remediation evidence
• Vulnerability scan results and penetration testing reports
• Backup and disaster recovery test logs
• Supplier due diligence records and subservice provider compliance reports
• Data centre contracts and documentation confirming physical location and jurisdiction

If any of this sounds familiar, it should, a solid SOC 2 Type II readiness programme produces most of the same artefacts.

How Securance can help

Getting to C5 attestation is absolutely doable, but it's a lot easier with people who've done it before. Securance works with SaaS and tech companies across Europe, combining advisory, assurance, and cybersecurity services under one roof, which matters here, because C5 touches all three.

Our approach typically starts with a structured readiness assessment against the C5 catalogue to give you a clear, prioritised view of your gaps. From there, our advisory team supports remediation, helping you build controls that are both auditable and practical for your team to maintain. Our assurance specialists then coordinate the audit engagement and manage the auditor relationship, so you're not navigating that process alone.

Because we use a Single Audit, Multiple Standards approach, organisations that come to us for C5 often find they can simultaneously satisfy requirements for ISO 27001, SOC 2, or DORA, without running separate, duplicated processes. For SaaS teams under pressure from German enterprise customers, that efficiency is worth a lot.

Over 800 professional firms and SMEs across Europe trust Securance with their compliance and security programmes. If BSI C5 is on your roadmap, we'd be glad to talk through where you stand.

FAQs

Is BSI C5 a certification or an attestation? It's an attestation. Unlike ISO 27001, which results in a certificate issued by an accredited certification body, C5 produces an auditor's attestation report under ISAE 3000. Both carry real weight with enterprise customers, but they're structurally different.

Is C5 relevant outside Germany? Increasingly yes. C5:2026 incorporates NIS2 alignment, making it relevant for cloud providers across the EU. It's also cited in procurement frameworks in Austria and Switzerland. That said, Germany remains the primary driver, if your customer base is German, C5 is hard to avoid.

Do I need C5 if I already have ISO 27001? Not automatically, but ISO 27001 alone won't satisfy C5 requirements. C5 adds cloud-specific controls and transparency obligations that ISO 27001 doesn't cover. If you have ISO 27001, you have a strong foundation, you'll likely need a targeted gap assessment and some additional controls rather than a full rebuild. You might also find our comparison of which compliance framework to start with useful here.

How much does a C5 attestation cost? Costs vary based on the scope of your cloud services, the maturity of your existing controls, and whether you're pursuing Type 1 or Type 2. Auditor fees, internal remediation effort, and advisory support all factor in. A readiness assessment is the best way to get an accurate picture for your specific situation.

What's new in C5:2026? The April 2026 update introduced specific criteria for container management, confidential computing, and post-quantum cryptography. It also deepened supply chain security requirements and aligned more closely with the NIS2 Directive. Organisations currently attested to C5:2020 should review the transition requirements and plan ahead.

Ready to get started? Talk to our experts for a free consultation on your C5 readiness.