BSI C5 gives engineering a list of auditable criteria and leaves the technical choices to you. The audit follows ISAE 3000 and may test a point in time or a period. A VP of engineering should settle scope, evidence sources and engagement type first, because those three decide the workload.
What does the audit actually test?
The BSI says C5 criteria are checked by an auditor you choose, such as a public accountant, who writes a detailed examination report under international standards. The report documents what was done during the examination and contains a system description of procedures, processes and measures. Depending on the engagement, the auditor checks that criteria are met on the examination date and whether they were also met earlier.
For engineering, that is the whole shape of the work: describe the system, show controls exist, and for a period engagement show they operated across the period.
Where does scope come from?
The catalogue says nothing about your repositories. Scope is the cloud service your customer will use. Draw the line around production, the pipelines that change it, the identity systems that gate it and the vendors that touch customer data. Anything outside the line should be unreachable from inside it, or you will argue about it in the audit.
Constructed example: a platform team runs production on managed Kubernetes, builds in a shared CI system and handles support through a ticketing tool where engineers paste log excerpts. The CI system and the ticket tool both touch customer data paths. A scope that lists only production is wrong, and the auditor will say so.
What evidence is cheap and what is expensive?
Cheap evidence comes from systems that already log by default: merged pull requests with approvals, deployment records, access change history, vulnerability scan results with dates. Expensive evidence is anything a person must remember to do and then screenshot. The BSI states the catalogue does not prescribe measures, so you may pick the control that produces evidence automatically. Do that where you can.
What about sub-service providers and government requests?
The BSI lists sub-service providers, data centre locations and handling of investigation requests from government agencies among the framework information the report must give. Engineering owns the data flow diagram that makes the first two answers true. Legal usually owns the third, but engineering must be able to say what data can be produced, from where, and who can retrieve it.
What changes with C5:2026?
The BSI says C5 was completely revised in 2025 and 2026, and lists C5:2026 beside C5:2020. It also says the cross-reference table of C5:2026 to international standards is scheduled for publication. If you already work to another control set, plan on mapping work and check the current BSI pages before you commit dates.
What usually goes wrong?
Teams treat the audit as a documentation sprint. They write policies, then discover that nothing in the pipeline proves the policy ran. The better order is the reverse: look at what your systems already record, write the control around that record, and only then write the paragraph that describes it. A second common miss is ownership. Each control needs a named person who answers the auditor, not a team alias, and that person needs time on the calendar during the examination.
How to apply this
- Confirm the edition your largest German buyer expects.
- Write the system boundary as a diagram plus a list of vendors, and get legal and security to sign it.
- Choose period or point in time with your auditor in writing, then align your change freeze and release calendar.
- Turn each criterion into one named control, one owner and one automatic evidence source.
- Run a dry evidence pull from the last 90 days before the auditor starts.
- Track exceptions in one place so you can explain each one.
Quick check
Does C5 tell me which tools to buy?
No. The BSI says the catalogue contains only auditable criteria and does not prescribe the measures used to meet them.
What audit standard does a C5 examination use?
The BSI names ISAE 3000 as the overarching framework of the audit methodology.
Sources
Last reviewed: 18 October 2026.
