You can start BSI C5 in spreadsheets: one sheet for criteria, one for controls, one for evidence, one for open gaps. Plan to automate when the evidence refresh takes longer than the fixing, when several frameworks overlap, or when your auditor asks for samples faster than you can find them.
What is C5, in one paragraph?
C5 is the Cloud Computing Compliance Criteria Catalogue from Germany's BSI, which sets minimum requirements for secure cloud use and makes a provider's security transparent through a standard examination and report. The BSI page lists C5:2020 and C5:2026 as versions and says the catalogue was completely revised in 2025 and 2026. Auditors of the provider's choice, such as certified public accountants, perform the examination. BSI does not pick them and does not check the reports. Confirm which version your customers expect before you build anything.
A spreadsheet design that works
Sheet 1, Criteria. One row per criterion in the version you are targeting: ID, text summary, applicability, owner.
Sheet 2, Controls. One row per control you operate. Columns: control ID, description, systems covered, frequency, owner. Link each criterion to one or more controls. This keeps one control from being duplicated six times.
Sheet 3, Evidence. One row per evidence item: control ID, what it shows, date captured, location, next refresh date, reviewer.
Sheet 4, Gaps. Criterion, finding, risk, fix owner, due date, status.
Sheet 5, Changes. Anything that alters scope: new region, new subprocessor, new product feature. C5 audits look at your system description, so changes belong on record.
Lock the criteria sheet and keep versions. Use a shared drive with edit history, not email attachments.
What can you do well by hand?
Scoping, writing the system description, owning policies, and deciding what is applicable. These need judgment, and a tool will not do them for you.
Where do spreadsheets break?
- Evidence age. Screenshots go stale. If the audit covers a period, you need evidence across that period, not one capture.
- Many systems. A control that spans ten accounts or fifty repositories is hard to prove by hand.
- Overlap. If you already hold SOC 2 or ISO 27001, the same control appears in three sheets that drift apart.
- Questions from customers. Each security questionnaire reuses the same answers, and copy and paste causes contradictions.
- People leave. The one person who understands the formulas moves on.
A test for when to automate
Count hours. If gathering and refreshing evidence takes more than half of the compliance effort, or you cannot answer "is this control still working today" without asking a person, you have outgrown the sheet. Another trigger is a second framework: shared controls are the cheapest thing to automate.
Mistakes to avoid
- Starting without checking which C5 version a customer's procurement team cites.
- Mapping criteria to policies only. Auditors test operation, not intent.
- Letting evidence age past the period your report covers.
- Building clever macros before the control list is settled.
What to do
- Confirm the target C5 version and the type of report your customers want.
- Build the five sheets and lock the criteria sheet.
- Map every criterion to a control and every control to evidence.
- Set a refresh date on each evidence row and review the list weekly.
- Track hours spent on evidence versus fixes each month.
- Pick one automatable control family, such as access or vulnerability evidence, and move it first.
- Brief your auditor on how evidence is stored before fieldwork begins.
Quick check
Is C5 a certification?
The BSI describes an examination and report by an independent auditor of the provider's choice. Treat it as an attestation, and ask the auditor how the report is named and what period it covers.
Can small teams start with spreadsheets?
Yes, for scoping and the first cycle. Move evidence collection to automation when refreshing it costs more time than fixing the gaps.
How Safeguard helps automate this
When the evidence sheet outgrows your team, Safeguard's compliance suite takes over the repetitive part. It covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot. Monitoring runs continuously between audits, which saves time to focus on other work, and one control can serve several frameworks.
Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability, not just policies. Safeguard's agent can open tested fix pull requests for vulnerable dependencies and other findings. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. The examination is carried out by an independent auditor. Safeguard helps you prepare and keep evidence ready.
See it at /demos/framework-mapping.
Want to see it on your own stack? Book a call.
Sources
Last reviewed: 18 October 2026.
