BSI C5 does not have a chapter called "software supply chain." Its relevant criteria sit in areas such as development and procurement of systems and oversight of suppliers. To map your controls, gather evidence of component inventory, vulnerability handling and supplier review, then match each to the catalogue wording your auditor uses.
What is C5, in one paragraph?
The Cloud Computing Compliance Criteria Catalogue, or C5, is published by Germany's Federal Office for Information Security (BSI). Per the BSI, it "specifies minimum requirements for secure cloud computing," and it is aimed mainly at professional cloud providers, their auditors and their customers. Providers choose their own auditors. The BSI does not pick auditors or check audit reports.
The BSI first published C5 in 2016 and says it was completely revised in 2025/26. Its page links to C5:2026, C5:2020 and older versions. Check which version your customer or auditor expects before you map anything, because this post does not compare the versions.
Where does supply chain work show up?
The 2020 catalogue is organised in domains. One mapping site lists a domain for procurement, development and modification of information systems, and the catalogue also deals with the control and monitoring of service providers and suppliers. We could not confirm individual criterion IDs or wording from a primary source while writing this, so the table below names the evidence, not criterion numbers. Take the numbers from the catalogue itself.
| Supply chain activity | Evidence an auditor can read |
|---|---|
| Know what is in your software | SBOMs per release, with versions and identifiers |
| Find and fix known flaws | Scan reports over time, with dates and fix records |
| Control what enters the build | Dependency pinning, lockfiles, review of new packages |
| Oversee suppliers | Supplier list, risk review, contract terms, reassessment dates |
| Protect the build | Branch protection, access lists, signed artifacts |
What does a C5 audit actually check?
The BSI says auditors check whether criteria are met at the time of the examination and, depending on the engagement type, whether they were met in the past. The report contains a system description of the provider's procedures and processes. So one clean scan on audit day is weaker than a record that shows the same control working month after month.
Customers carry responsibility too. The BSI tells them to obtain the C5 report, analyse it, repeat that yearly, and decide whether the baseline is enough or additional criteria apply to them. If you sell to German customers, expect questions about your suppliers' reports, not just yours.
How can tooling help, and where does it stop?
A scanner can produce the inventory and finding history. It cannot write your supplier risk process or show that a person reviewed it. Safeguard's compliance documentation says each framework page states which requirements a scan decides and which need your own evidence, and that the readiness score is "not an audit opinion or a certification." Its framework library lists related German entries such as BSI IT-Grundschutz and BSI TR-03183-2; we did not find a separate C5 entry on the page we checked, so do not assume one.
Nothing here means a tool certifies you against C5. Only an attestation from an auditor you have engaged does that.
What to do
- Confirm with your customer or auditor which C5 version applies to the audit period.
- Pull the catalogue and list every criterion touching development, procurement and suppliers.
- For each, name one artifact that proves it, such as an SBOM export or a supplier review record.
- Fill the gaps that are process, not tooling: who reviews a new supplier, and how often.
- Keep dated records so you can show the control worked over the period, not on one day.
Quick check
Does C5 require an SBOM?
We could not confirm SBOM wording in the catalogue from a primary source. An inventory of components is still the easiest way to evidence development and supplier controls, so check the criteria text with your auditor.
Who issues a C5 attestation?
An auditor the provider mandates. The BSI does not select auditors and does not check audit reports.
Sources
- BSI, Criteria Catalogue C5
- Safeguard docs, Compliance
- Safeguard docs, All frameworks
- Safeguard docs, How framework coverage works
Last reviewed: 18 October 2026.
