BSI C5 is the German Federal Office for Information Security's cloud criteria catalogue. You do not apply to BSI. You commission an auditor of your choice, who examines your service against the criteria and writes a report with a system description. A 12 week plan can get you ready for that examination, though the exam timeline is the auditor's.
What is C5 and who is it for?
BSI describes C5 as a baseline security catalogue for professional cloud providers, their auditors and their customers, first published in 2016. It sets minimum requirements and gives a standard way to report on information security. On the BSI page we fetched on 18 October 2026, two versions were listed, C5:2026 and C5:2020, and BSI said the catalogue was completely revised in 2025 and 2026 without describing the changes on that page. We could not confirm the detail of the new version, so read the catalogue itself.
BSI states it is not involved in selecting auditors or checking audit reports. Customers are expected to obtain your report, analyse it, ideally yearly, and decide whether the baseline fits their use case.
What does the report look like?
Auditors check whether criteria are met at the time of the examination and, depending on the engagement type, whether they were also met over a past period. The output follows international standards and includes a system description. The system description is your own document, so it is where the DIY effort goes.
The calendar
Week 1: decide the target. Ask your German and European customers which version they expect and whether they need a point in time or period report. Pick the in scope cloud service, its locations and its supporting teams.
Week 2: get the catalogue and map it. Download the version you chose. Build a spreadsheet with each criterion, its owner, your control and your evidence.
Weeks 3 and 4: gap assessment. Mark each row met, partly met or not met. Be honest. Group gaps by owner: engineering, operations, HR, legal.
Weeks 5 to 8: close the gaps. Start with the ones that take calendar time: policies approved by leadership, supplier contracts, training, tests of backup and recovery, and access reviews that must run before you can show them. Anything that needs repetition should start early.
Week 9: draft the system description. Describe the service, its components, infrastructure, people, processes, subservice providers and the responsibilities left to the customer. Have an engineer and a lawyer read it.
Week 10: internal test. Pick a sample of rows and have someone outside the owner team test them, as an auditor would.
Week 11: choose the auditor and brief them. Use public accountants or other auditors qualified for this kind of examination. Share scope, the version, the system description and your gap closure log. Ask about their approach, their timeline and what evidence format they prefer.
Week 12: fix findings and freeze scope. Close what the internal test found, confirm dates for fieldwork and agree the evidence portal.
Mistakes to avoid
- Picking the wrong version for what customers ask. Confirm before you map.
- Leaving subservice providers out of the system description.
- Writing policies in week 11 for controls that need operating history.
- Expecting BSI to review or approve your report.
What to do
- Confirm the C5 version and report type with your top three customers.
- Download the catalogue and build the criteria mapping sheet.
- Run the gap assessment and rank gaps by lead time.
- Start long lead items in week five and schedule the repeatable ones.
- Draft the system description and have it reviewed.
- Shortlist two or three auditors and ask for their method and timeline.
Quick check
Does BSI certify us?
On the BSI page, auditors you commission produce the report. BSI says it does not select auditors or check reports.
Can twelve weeks really be enough?
It prepares you for the examination. Controls that need operating history, and the auditor's schedule, can add time beyond the twelve weeks.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so the criteria mapping sheet you build in week two can be backed by evidence collected from connected systems and code instead of screenshots. Between audits, monitoring keeps running, which frees the team to focus on other work. Technical evidence, such as scans, SBOMs and reachability, comes from your real software. Autonomous remediation can open tested fix pull requests, but it is off by default, every category starts on Manual and you set which categories run automatically. Safeguard helps prepare and keep evidence ready, and the independent auditor does the examination. See the framework mapping demo.
Sources
- BSI, Kriterienkatalog C5, fetched 18 October 2026. The page did not describe the 2025 and 2026 changes.
Last reviewed: 18 October 2026.
