To scope a BSI C5 audit, define the specific cloud service you offer, write a system description that sets its boundaries, list the locations, infrastructure and subservice providers behind it, and agree the engagement type with your auditor. BSI does not choose your auditor or review your report.
C5 is the Cloud Computing Compliance Criteria Catalogue from Germany's Federal Office for Information Security (BSI), first published in 2016. On 18 October 2026 the BSI page listed both C5:2026 and C5:2020 and said C5 was completely revised in 2025 and 2026. Confirm which edition your customers and your auditor expect before you start.
Who audits and what do they produce?
The BSI page says providers commission certified public accountants or other auditors of their choice. BSI is not involved in selecting auditors and does not check audit reports. The audit report contains a system description in which you document procedures, processes and measures. Auditors check whether criteria are met at the time of the investigation and, depending on the engagement type, whether they were met in the past. That wording points to point in time versus period engagements, but the page does not define them, so ask your auditor which you are buying.
What is the unit of scope?
A cloud service, not a company. Pick the one service customers consume, such as a platform, an API or a managed application. A provider with several services can scope them separately or together, so decide by how customers buy them and how infrastructure is shared.
What belongs in the system description?
The page does not give a template, so work from what auditors need to test:
- The service, its functions and the customers it serves.
- Components: infrastructure, software, people, processes and data.
- Locations: regions and data centers where customer data is stored or processed, and where support staff access it.
- Subservice providers: the hosting provider and any other party that operates part of the service, with the controls you rely on from them.
- Interfaces and customer responsibilities.
Be precise about boundaries because customers read this part. The BSI page tells customers to analyze the C5 report yearly in their own risk assessment and says they remain responsible for residual risk and for judging whether the baseline suffices for their use case.
How do you handle subservice providers?
Decide, with your auditor, whether the report includes the provider's controls or relies on the provider's own report and describes them as complementary controls. We could not verify C5 specific rules for this from BSI's page, so treat it as a question for your auditor and ask for their approach in writing.
Where do first timers go wrong?
- Scoping the whole company rather than one service.
- A system description written by marketing, not engineering.
- Forgetting the support and administration paths that reach customer data.
- Assuming the cloud provider's certificate covers your own controls.
- Not tracking which edition of C5 applies.
What to do
- Pick the single cloud service and write its boundary in a paragraph.
- Confirm the C5 edition with your auditor and your largest German customers.
- List components, locations and staff access paths.
- Build the subservice provider register with the reports you hold.
- Draft the system description with engineering input.
- Agree engagement type, period and timeline with the auditor before fieldwork.
Quick check
Does BSI review C5 reports?
No. The BSI page says it does not check audit reports and is not involved in selecting auditors.
Is C5 a certificate?
The BSI page describes an audit report from an auditor, containing a system description and results, rather than a certificate issued by BSI.
How Safeguard helps automate this
After scoping, C5 needs proof that controls work across the service. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs continuously between audits, which leaves time for other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. Autonomous remediation can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically. The independent auditor issues the report. Book a call to see it.
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue C5, fetched 18 October 2026
Last reviewed: 18 October 2026.
