To prepare for a BSI C5 audit, map every in scope criterion to a named control, then to dated evidence that shows the control ran, not just that it exists. An independent auditor tests that evidence under ISAE 3000. BSI does not audit you, pick your auditor, or review the report.
What exactly gets audited?
A C5 audit covers one or more cloud services in defined regions. The attestation is issued for those services, not for your company as a whole. At minimum the auditor checks all basic criteria. If you add the additional criteria for customers with higher protection needs, those join the scope.
C5 is a catalogue of testable criteria. It does not tell you which tool to buy. You choose the control, and the auditor checks it against the criterion.
The report is more than a pass mark. BSI describes five parts: the auditor's opinion, a statement from your legal representative, your system description, the criteria with your controls and the auditor's test results, and optional other information from you. Your system description is the document everything else hangs on, so write it early.
Type 1 or Type 2: how does the evidence differ?
A Type 1 report gives an opinion on whether controls are suitably designed and implemented at a point in time. A Type 2 report adds an opinion on operating effectiveness over a period. BSI's own example is criterion OPS-02 on monitoring. For Type 1 the auditor confirms the monitoring software is running with sensible thresholds. For Type 2 you must also show it ran continuously, with logs that reveal gaps or threshold breaches.
BSI says a Type 2 is needed for real informative value, and that a Type 1 should only be used for the first audit of a service, never several times in a row. Customers are told to ask questions if they keep receiving Type 1 reports. Plan for Type 2 from the start.
What do the general conditions add?
C5 has transparency requirements next to the security criteria. You disclose where data is processed, which jurisdiction applies, which subcontractors you use and which other certificates or reports exist for the service. Treat these as documents to prepare, not a form to fill in on audit week.
Subcontractors matter. BSI says you must pass the criteria down to them, and the report lists the complementary subservice organisation controls you rely on. Collect their audit reports before your auditor asks.
Which version should you build toward?
BSI published C5:2026 with 168 criteria in 17 subject areas, up from 121 in C5:2020. Each criterion now has sub-criteria, and additional criteria are marked as sharpening a basic one (replacing it) or complementing it (adding a requirement). Per BSI, C5:2026 applies to engagements with a specified date or a period that begins on or after 1 June 2027, and earlier adoption is allowed. If your period ends on or after 28 February 2027, add notes on planned control changes to your system description. Ask your auditor which version they will test against.
What to do
- Fix the scope: which services, which regions, which subcontractors.
- Download the criteria catalogue (PDF, Excel or the YAML files) and build a sheet with one row per criterion and sub-criterion.
- For each row, name the control, the owner, how often it runs and where its evidence lives.
- Write the system description and the general conditions answers, and have your legal representative read them.
- Collect subcontractor reports and list the controls you depend on them for.
- Run a mock audit. Ask someone outside the control owner to pull three samples per control from your evidence store, with dates.
- Close gaps, then agree the audit window and sampling approach with your auditor.
- During the period, keep logs, tickets, review records and approvals in one place, named by control.
Quick check
Does BSI certify C5 compliance?
No. BSI publishes the catalogue. Independent auditors perform the examination and issue the attestation. BSI does not select auditors or check audit reports.
Can customers demand the full C5 report?
Not as of right. BSI says the report belongs to the provider, though it is usually in the provider's interest to share it so customers can make an informed decision.
How Safeguard helps automate this
C5 evidence has to be dated, repeatable and tied to a criterion. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot. Monitoring runs between audits, which helps with the Type 2 requirement to show a control ran all period. Technical evidence comes from your real code and dependencies, including scans, SBOMs and reachability, which suits the supply chain and subcontractor questions. Safeguard's agent can also open tested fix pull requests for vulnerable dependencies. That is off by default, every category starts on Manual, and you choose which categories run automatically. The audit itself stays with your independent auditor. Book a call to see it mapped.
Sources
Last reviewed: 18 October 2026.
