C5, the Cloud Computing Compliance Criteria Catalogue from Germany's Federal Office for Information Security (BSI), sets minimum requirements for secure cloud services. Providers show alignment through an auditor's examination report. A CTO decides whether German customers require it, which services to include, and which type of report to commission.
What is C5?
According to the BSI, C5 specifies minimum requirements for secure cloud computing and is aimed at professional cloud providers, their auditors and customers. It was first published in 2016. The BSI says it was completely revised in 2025 and 2026, with C5:2026 now listed alongside C5:2020. Confirm which edition your customers and auditor are using.
How does a C5 report work?
A provider mandates a public accountant or other auditor of its choice to examine its cloud service against the criteria. The BSI says auditors check whether criteria are met at the time of the investigation and, depending on the engagement type, whether they were also met in the past. The auditor produces a detailed report with a system description stating which procedures, processes and measures satisfy C5.
Notably, the BSI is not involved in selecting auditors and does not check the reports. Customers are expected to obtain the report and analyze it in their own risk assessment, and to repeat that yearly. Residual risk stays with the customer.
Why does that matter to a CTO?
It means the report is a communication tool between you and the buyer. Buyers will read your system description and look for gaps against their own needs. They may also ask whether the baseline is enough for their use case. A thin or vague description invites follow-up questions.
The BSI also stresses transparency about the split of security-critical tasks between provider and customer. A constructed example: a SaaS analytics provider states that it manages encryption keys by default and offers customer-managed keys as an option. A German bank customer reads that and decides which model it needs. A report that glosses over the question creates delay.
Is this the same as SOC 2 or ISO 27001?
No. All three are evidence formats with overlapping subject matter, and an organization with one can reuse much of the work. They are different documents with different criteria and audiences. Do not describe a C5 report as equivalent to another attestation.
What makes a system description good?
Buyers read the system description closely because the BSI leaves interpretation to them. A good one names each service, its components and its locations, states which controls are the provider's and which belong to the customer, and lists subservice organizations. It avoids vague phrases such as "industry standard encryption" and says which algorithms, who holds keys and how rotation works.
Write it as if a skeptical customer security engineer will read it with the criteria beside them. Where a criterion is not met or is met partly, say so plainly with the compensating measure. Auditors and customers both trust a candid description more than a perfect-looking one, and it reduces back-and-forth later.
How to check or apply this
- Ask German and EU public-sector or regulated customers whether they require a C5 report and which edition.
- Define the in-scope cloud services and regions.
- Map existing controls and prior reports to the C5 criteria to find the gap.
- Write a clear shared-responsibility statement for each in-scope service.
- Choose an auditor with C5 experience and agree the engagement type: point in time or covering a period.
- Plan yearly refresh, since customers are advised to review reports annually.
- Publish the report under NDA through your trust process.
Evidence from dependency inventories and vulnerability management can support several criteria, and Safeguard's SBOM and compliance automation can help organize it. The report must come from an auditor.
Quick check
Does the BSI issue C5 certificates?
No. The BSI publishes the criteria. Reports come from auditors you engage, and the BSI does not check them.
Is C5 only for German companies?
No. The BSI says it is used by national, European and global providers.
Sources
Last reviewed: 18 October 2026.
