C5, the Cloud Computing Compliance Criteria Catalogue, is a catalogue from Germany's BSI that sets minimum security requirements for cloud services. A provider hires an auditor, who examines it against the criteria and writes a report. Customers read that report as part of their own risk analysis. It is an audit report, not a BSI certificate.
What BSI says
BSI first published C5 in 2016. It aims to make information security transparent through a standardized examination and report. The page we read says C5 was completely revised in 2025 and 2026, with C5:2026 as the newer revision and C5:2020 still linked. It does not list the specific changes, so check the C5:2026 section on BSI's site if you need them.
How the report comes about
The cloud provider mandates a certified public accountant or other auditor of its choice. The auditor examines the provider against the criteria and produces a detailed report under international standards. It includes a system description of the provider's procedures, processes and measures. BSI states it is not involved in selecting auditors and does not check the audit reports.
That last point matters. When someone says "C5 certified", ask who audited, what scope, and for which version.
Who asks for it
BSI describes the audience as professional cloud service providers, their auditors and their customers. We cannot give you a list of buyers who demand it from the pages we read. In practice, if you sell cloud services into German organizations, expect procurement to ask. Confirm with each buyer which version and report type they accept.
What a customer should do
BSI says customers should order the report, analyse it, repeat this yearly, and run their own risk assessment. They must also judge whether the baseline suffices or whether extra criteria apply.
A reading checklist, our own:
- Which service and locations does the report cover?
- Which criteria version was used?
- Does the report cover a point in time or a period? BSI says auditors check whether criteria are met at the time of examination and, depending on the engagement type, whether they were met in the past.
- Which exceptions did the auditor note?
- Which controls are left to you as the customer?
What a provider should do first
Run a gap analysis against the criteria, assign owners, and collect evidence early. Ask your auditor how the 2026 revision affects timing.
See also how to read an attestation report.
Quick check
Does BSI check C5 audit reports?
No. BSI says it does not select auditors or check the reports.
Which C5 version should I use?
Ask the buyer. BSI links both C5:2026 and C5:2020, and the 2026 revision is newer.
Sources
Last reviewed: 19 October 2026.
