BSI C5 for a startup: a practical first 90 days

BSI C5 is a criteria catalogue from Germany's Federal Office for Information Security, and a cloud provider proves it with an audit report, not a certificate. A startup's first 90 days should fix the scope, run a gap assessment against the criteria, build evidence habits, and agree with an auditor whether to start with a Type 1 or go straight toward Type 2.

What is C5, exactly?

According to BSI, the Cloud Computing Compliance Criteria Catalogue gives customers transparent reporting on the information security of a cloud service. It has 17 subject areas. C5:2020 has 121 criteria and C5:2026 has 168. The criteria are auditable and do not prescribe specific measures, and the audit framework is ISAE 3000.

Two things surprise startups. The provider chooses and pays the auditor, and BSI neither appoints nor reviews them. And BSI notes that existing certificates for other standards, such as ISO 27001, are generally not recognised inside a C5 attestation, though running audits together can save effort. Federal authorities must follow it when procuring cloud services for official data. For everyone else it is recommended, which is why German buyers tend to request the report.

This post explains the framework. Safeguard does not claim a C5 attestation, and no tool can give you one.

Type 1 or Type 2?

BSI says a Type 1 report assesses whether controls are suitably designed and implemented at a point in time. Type 2 adds operating effectiveness over an audit period, typically 6 or 12 months. BSI considers Type 2 necessary for meaningful assurance and says Type 1 should be used only for an initial audit and not repeated.

For a startup this means a Type 1 can be a first step, but buyers will want Type 2 soon after.

Days 1 to 30: scope and gaps

1. Pick the version with your auditor, since BSI lists both C5:2020 and C5:2026 on its page.
2. Define the service in scope, its components, locations and subservice providers. The report includes a system description, so you will write one.
3. Read the criteria across all 17 areas and mark each as met, partly met or not met, with an owner.
4. Find out who your auditor can be. Auditor qualifications are set out in chapter 3 of the catalogue, and BSI recommends writing them into the contract.
5. List your subservice providers, such as the cloud platform, and gather their own reports.

Days 31 to 60: close the cheap gaps and build evidence

1. Write the missing policies and procedures and have management approve them.
2. Turn on evidence collection. Access reviews, change records, vulnerability scan results and incident tickets need dates. Type 2 samples across a period.
3. Run an access review and a backup restore test once so you know the procedure works.
4. Set up vulnerability and dependency tracking for your own code. Safeguard's dependency inventory and compliance automation can hold this evidence next to the criteria.
5. Test your incident process with a short tabletop exercise.

Days 61 to 90: readiness and the audit plan

1. Hold a readiness review with the auditor or an advisor.
2. Decide Type 1 first or Type 2 straight away. Write down the audit period and the start date.
3. Draft the legal representative's statement and the system description. BSI describes a five part report: the auditor's report, the statement, the system description, the criteria and test results, and optional provider information.
4. Assign an owner for every open gap, with dates.
5. Prepare a short customer summary that explains what the report covers and what it does not.

Quick check

Sources

• BSI, Cloud Computing Compliance Criteria Catalogue C5
• BSI, C5 introduction

Last reviewed: 18 October 2026.