For a product manager, BSI C5 is less a security project than a disclosure project. The report describes your cloud service, its sub-service providers, where data centres sit and how government requests are handled. Your roadmap decides whether those answers stay stable or change under the auditor's feet.
What does C5 put on a product's plate?
The BSI describes C5 as a baseline of minimum requirements for cloud services, used by providers, auditors and customers who share responsibility for information security. It also says the catalogue helps customers see how security tasks are divided between provider and customer. That division is a product matter. Every feature that moves a task from the customer's side to yours, or back, changes what the report has to say.
Which parts of the report touch product decisions?
The BSI lists framework conditions that the report must cover. They include availability and troubleshooting information, the sub-service providers used, the location of data centres, and the handling of investigation requests from government agencies. Each one has a product owner behind it.
Sub-service providers: adding a new analytics vendor, an AI model API or a support tool that receives customer data adds a name to that list. Region choice: a new storage region changes the data centre answer. Support tooling: whoever can see customer content during troubleshooting is part of the description.
Constructed example: a team ships an in-app assistant that sends document text to a third party model endpoint in another region. Nothing in the security test plan flags it. Six months later the C5 system description lists sub-service providers and the assistant's vendor is missing. The fix is a release gate, not a heroic audit week.
How does the audit timing affect releases?
The BSI says auditors check whether criteria are met when they examine, and, depending on the engagement type, whether they were also met in the past. If your audit covers a period, a change made mid period must be controlled and documented. A product manager does not need to run the controls, but should know the freeze dates, the change approval path and who signs off.
Does C5 tell me which features to build?
No. The BSI says the catalogue contains only auditable criteria and does not prescribe measures. You will not find a list of product features. You will find outcomes that someone must be able to evidence.
What goes wrong without an owner?
The usual failure is quiet drift. A vendor gets added in a sprint, a region gets switched for latency, a support macro starts asking customers to paste logs. None of these is a security decision in the room where it is made. By the time the report is drafted, nobody remembers why the list changed. A short register with a named owner per feature turns that drift into a visible edit, and it costs far less than reconstructing history under audit pressure.
What should I do now?
- Ask the security lead which C5 edition customers are asking for. BSI lists C5:2026 and C5:2020.
- Build a one page register of sub-service providers per feature, with the data each receives and where it runs.
- Add three questions to every feature review: does it add a processor, does it move data to a new location, does it change who can see customer content.
- Write down the government request handling process in plain words and name the owner. The report discusses this topic explicitly.
- Mark features that change the customer and provider split of responsibilities, and tell the customer success team before release.
- Review the register before each release, not before each audit.
Quick check
Is C5 a certificate I can show on a pricing page?
It is an audit report written by an independent auditor, not a BSI certificate. The BSI says customers should order and analyse the report themselves, yearly. Describe it accurately and check wording with your auditor.
Who owns the sub-service provider list?
The report covers it, so someone must own it. In practice that is the product owner of each feature that sends data to a vendor, with security reviewing the register.
Sources
Last reviewed: 18 October 2026.
