BSI C5 is an examination and report, not a one off certificate, so the work after your report is keeping controls running and provable. Monitor control checks, system changes, incidents and subservice providers, so that when the next examination comes the evidence already exists for the whole period.
What does "pass" mean for C5?
The BSI describes C5 as a catalogue of minimum requirements for secure cloud computing, made transparent through a standardized examination and report. Auditors of the provider's choice, such as certified public accountants, carry it out, and BSI does not choose them or check their reports. Depending on the engagement, auditors check whether criteria were met at the time of examination and whether they were met in the past. The BSI page lists C5:2020 and C5:2026. Secondary sources say reports can cover a point in time or a period. Confirm with your auditor which applies to you.
Because customers read the report as a statement about how you operate, a report that sits unrefreshed loses value.
What should you monitor?
Control operation. Pick a test for every control you listed in the system description and run it on a cycle: access reviews, backup restores, patch status, log review, key rotation. Record the date, result and reviewer.
Changes. C5 examinations look at your described system. Log every change that affects it: new regions, services, subprocessors, architecture shifts, major releases. Each gets a security review before release.
Incidents. Keep an incident register with classification, timeline, cause, customer notice and corrective action.
Subservice providers. Track your hosting and tooling suppliers, collect their latest reports or attestations, and note any gaps you rely on them to cover.
Deviations. Whenever a control fails, record it, fix it, and keep the closure evidence. An examination will find these in samples, and a pattern of caught and fixed issues is better than none recorded.
Catalogue changes. BSI says C5 was completely revised in 2025 and 2026. Watch BSI announcements and plan a mapping from your current controls to the newer catalogue before your customers ask for it.
A monitoring rhythm
Continuous: configuration drift alerts, vulnerability findings, access anomalies.
Monthly: change log review, incident review, supplier notices.
Quarterly: access reviews, restore tests, management review of control results.
Yearly: risk analysis, penetration test, policy review, subprocessor reassessment, readiness check before the next examination.
What evidence should you keep?
- Dated control test results with reviewer names
- Change records and approvals
- Incident register and post incident reviews
- Supplier reports and your review notes
- Management review minutes
- Corrective action log
How do you make the rhythm stick?
Give each check an owner and a ticket that recurs automatically. Review the open and overdue list in the monthly meeting, and report the counts to management each quarter. A missed check is itself a finding: record it, run the check late, and note why it slipped. Small, steady records over the whole period are more convincing to an auditor than a large collection assembled in the final weeks, and they make the next readiness check an hour of review instead of a project.
Mistakes to avoid
- Waiting until audit prep to run the tests.
- Changing scope without telling the auditor.
- Relying on suppliers without reading their reports.
- Not recording failures, then having an auditor sample one.
What to do
- Write a test for every control and put each on a calendar.
- Record each result with date, reviewer and evidence link.
- Review changes and incidents monthly.
- Collect supplier reports and note carved out areas.
- Hold a quarterly management review and keep minutes.
- Map your controls to the newer catalogue version early.
- Run a readiness check a quarter before the next examination.
Quick check
Does C5 expire?
Because C5 is an examination report, what matters is the period or date it covers and how recent it is. Ask your auditor and your customers what they treat as current.
Who checks C5 reports?
Customers read them. The BSI states it does not select auditors or check the reports.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits. That fills in the period an auditor will want to see.
Technical evidence comes from your real code and dependencies, through scans, SBOMs and reachability, not only policies, which supports your secure development and vulnerability controls. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and set the approval level. The examination is performed by an independent auditor. Safeguard helps prepare and keep evidence ready, and does not replace the auditor.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
