BSI C5 is a cloud security criteria catalogue from Germany's Federal Office for Information Security. An independent auditor examines your cloud service against it and writes a report your customers read. A founder should start only when a German buyer, especially a public body, asks for that report.
What is C5, in founder terms?
The BSI describes C5 as a catalogue of minimum requirements for secure cloud computing, aimed at cloud providers, their auditors and their customers. It was first published in 2016 and, according to the BSI, was completely revised in 2025 and 2026. The current edition is called C5:2026, and the 2020 edition remains listed as a previous version.
Two things matter for you. First, C5 is a report, not a certificate you buy from the BSI. The provider hires a public accountant or another auditor of its choice. The BSI says it takes no part in choosing auditors and does not check audit reports. Second, the report is aimed at a reader. Customers are expected to order it, analyse it and repeat that every year as part of their own risk assessment.
Who actually asks for it?
The BSI states that for federal authorities, following the catalogue is required under the minimum standard for external cloud services when they buy cloud services to process official data. For everyone else it is a recommendation. So the realistic trigger is a German public sector deal, or a private buyer that borrows the public sector's habit.
Constructed example: a seed stage company sells a document workflow tool. A German state agency pilots it and the procurement officer asks for "a C5 report or equivalent". The founder has a US style security questionnaire and nothing else. The useful reply is not "we are working on it". It is a dated plan that names the auditor type, the scope, and what the agency can read in the meantime.
What does the report contain beyond controls?
The BSI says the report content is defined by specifications and includes framework conditions of the service. Those cover availability and troubleshooting information, the sub-service providers you use, the geographic location of data centres, and how you handle investigation requests from government agencies. A founder who has never written down which sub-processors host customer data in which country will find this the hardest part, not the technical controls.
Is C5 a prescriptive checklist?
No. The BSI says the catalogue only contains criteria that can be audited and does not prescribe the measures used to meet them. You choose the how. The audit methodology rests on ISAE 3000, and the BSI says auditors check whether criteria are met at the time of examination and, depending on engagement type, whether they were met in the past too. Ask any auditor you talk to which engagement type they are proposing, because that decides whether you are showing a snapshot or a period.
What does it cost you if you wait?
If no buyer has asked, waiting costs little. The report describes a service as it runs, so starting before you have a stable product and a stable vendor list tends to produce a report that is out of date within months. If a buyer has asked and you have no plan, the cost is a stalled deal, because buyers want a dated answer and a plan. The middle path is to prepare the one page vendor and location list now, since you need it for questionnaires anyway, and book the audit only when a real deal depends on it.
How to decide
- Ask the buyer what they actually need: C5:2026, C5:2020, or an equivalent. Do not guess.
- List your sub-service providers and data centre locations in one page. If you cannot, fix that first.
- Check the cross-reference situation. BSI publishes mappings from C5:2020 to international standards, and says the C5:2026 table is scheduled. If you already hold another framework report, ask the buyer how much overlap they accept.
- Request quotes from auditors who have done C5 engagements, and ask for the engagement type in writing.
- Set the scope to the service the buyer will use, not the whole company.
- Keep a decision log so the next buyer gets the same answer.
Quick check
Does the BSI certify my company?
No. The BSI states it does not select auditors and does not check audit reports. Your chosen auditor examines you and issues the report.
Do I need C5 to sell to private German companies?
Not by law. The BSI describes the catalogue as a recommendation for customers and providers. Federal authorities are the group with a stated requirement when they buy cloud services for official data.
Sources
Last reviewed: 18 October 2026.
