BSI C5 explained for a first security hire at a cloud provider

BSI C5, the Cloud Computing Compliance Criteria Catalogue, is a German catalogue of minimum security requirements for cloud services. A provider hires an auditor to examine against it and receives a report. The BSI itself does not pick auditors or check reports. Customers read the report and judge it against their own risk.

What is C5, exactly?

The Federal Office for Information Security (BSI) first published C5 in 2016. It sets a baseline for cloud security and is aimed at professional providers, their auditors and their customers. The BSI says the catalogue was completely revised in 2025 and 2026, and a C5:2026 version sits alongside C5:2020 on its site. Check which version a customer expects before you scope work.

It is a criteria catalogue and a reporting model. There is no certificate issued by BSI. The evidence is the auditor's examination report, including a system description of the procedures and measures the provider applies.

Who uses the report?

Customers. The BSI advises cloud customers to request the provider's C5 report, analyse it as part of their own risk assessment, and repeat that yearly. Public sector buyers in Germany and regulated firms often ask for it. The report also helps customers see how security duties split between provider and customer, which is why it appears in procurement.

The BSI is plain about responsibility: the customer decides whether the baseline is enough for their use case and carries any residual risk. As a provider, expect pointed questions about the gaps and exceptions in your report, not only its existence.

What is the first security hire's job here?

You are not the auditor, and you do not decide the opinion. You prepare the ground.

First, confirm the scope: which cloud services, which locations, and which version of the catalogue. Second, find out what the auditor will test, and whether the engagement looks at design only or also at operation over a period. The BSI notes that auditors check whether criteria are met at the time of examination and, depending on engagement type, whether they were met in the past too. Third, build the evidence trail for the areas auditors always ask about: access control, change management, logging, incident handling, and supplier management.

What do you decide, and what do you hand off?

Decide the evidence sources, owners and cadence. Hand off the choice of auditor and engagement type to leadership, since cost and timeline follow from it. Hand off any customer-facing statement about the result to whoever owns legal and marketing review, and make sure it describes the scope accurately.

What should you avoid saying?

Do not say a service is "C5 certified" unless a report exists and you can state its scope, date and type. Avoid implying the BSI reviewed or approved your service, because the BSI says it does not check audit reports.

How to check or apply this

1. Ask sales which customers require C5 and which catalogue version.
2. Fix the service scope in writing.
3. Choose an auditor and engagement type with leadership.
4. Map your existing controls to the catalogue areas and list gaps.
5. Set up recurring evidence for access, change and logging.
6. Plan to refresh the report each year, since customers are told to re-read it yearly.

Quick check

Sources

• BSI C5 criteria catalogue

Last reviewed: 18 October 2026.