BSI C5 is a criteria catalogue that sets a baseline security level for cloud services. An auditor examines you against it and writes a report, which customers read as part of their own risk analysis. DevOps leads supply the operational evidence and need to know which edition applies.
What exactly is C5?
The Federal Office for Information Security, BSI, first published the Cloud Computing Compliance Criteria Catalogue in 2016. It sets minimum requirements for secure cloud computing and is aimed at providers, their auditors and customers. BSI says over a hundred attestations have been granted to national, European and global providers, including small and mid sized ones.
BSI also says C5 was completely revised in 2025 and 2026. Its pages list C5:2026 alongside C5:2020 and earlier versions. Confirm with your auditor which one your engagement uses.
How is the report produced?
You mandate a public accountant or another auditor of your choice. BSI states it does not select auditors and does not check reports. The auditor examines whether criteria are met at the time of examination and, depending on the engagement type, whether they were met over a past period. The result is a detailed report with a system description that states which procedures, processes and measures you have implemented.
That wording matters for DevOps. A report that covers a past period needs records across that whole period, not a snapshot built the week before.
Who carries what?
BSI emphasizes shared responsibility. Customers should order your report, analyse it, and repeat that each year. They decide whether the baseline is enough for their use or whether extra criteria apply, and they carry residual risk. C5 helps make visible which security tasks sit with you and which with the customer.
So expect follow up questions. A customer reading your report may ask how a described control works in their tenant, or what they must configure themselves.
A constructed example
A platform team provides a managed database service. The system description says all administrative access uses short lived credentials and is logged. The auditor samples twelve months of administrative sessions. Eleven months line up. For one month, a migration used a temporary bastion with long lived keys that was never recorded. The criterion is met on paper and weak in practice for that period, and the report must say so. Better to find it first.
What to do
- Confirm with your auditor the C5 edition and the type of engagement, point in time or period.
- Write the system description from what the platform does today, and have engineers review it.
- Collect evidence by control owner: access reviews, change records, backups, monitoring and incident handling.
- Keep evidence for the whole examination period, with dates.
- Document the split of duties so customers know what they configure.
- Prepare a short customer facing note explaining how to read the report.
- Schedule the annual cycle so evidence collection is routine.
Safeguard can add dependency and vulnerability evidence for your own software, and compliance automation to track controls. It does not perform a C5 examination.
Quick check
Does BSI review C5 reports?
No. BSI says it is not involved in selecting auditors and does not check audit reports. Customers analyse them.
Is the C5 report a one time document?
BSI advises customers to order and analyse it yearly, so plan for a recurring cycle.
Sources
Last reviewed: 18 October 2026.
