How do you use a C5 report to answer security questionnaires?

Cite the C5 report by edition, scope, date and auditor, attach it under NDA, and point each questionnaire item to the relevant criteria instead of rewriting answers. Answer separately anything outside the report's system description, because BSI says the report covers the system it describes at the time of examination.

What makes a C5 report useful here?

Questionnaires repeat. A German customer's form often asks the same things in different words: who can access production, how are changes approved, where is data stored. If an independent auditor has already examined those topics, a report saves you from inventing a fresh answer each time.

BSI says customers use standardized audit reports to compare providers and to base their own risk assessments on them. It also says auditors check whether criteria are met at the time of the investigation, and that the report includes a description of the system. Those two facts decide how you can use it.

What are the limits of citing it?

• Scope. If the report describes your production service in two regions, a question about your internal corporate network or an acquired product is not covered.
• Time. A report is a snapshot. State the date or period, and say what has changed since.
• Edition. BSI revised the catalogue in 2025 and 2026 and links both a 2026 and a 2020 edition on its page. Name the one your report uses.
• Wording. Do not call it a certification, and do not say the customer is compliant because you hold it. Their compliance is theirs.

How do you build the answer library?

Create one shared document that maps common questionnaire topics to evidence. For each topic keep three fields: the short answer, the pointer into the report, and the date it was last checked.

Typical topics:

1. Access control and privileged access
2. Change and release management
3. Logging and monitoring
4. Incident handling and customer notification
5. Subcontractors and where data is processed
6. Vulnerability handling and patch timelines
7. Backup and recovery
8. Exit: data return and deletion

We did not fetch the C5 criteria list for this post, so we do not number or name its sections here. Get the real mapping from the catalogue and your auditor, and keep it in the library.

What should you answer yourself?

Anything the report does not state. Examples are a specific retention period a customer asks for, a named person for incident contact, or a custom contract term. Also answer yourself when a question is newer than the report, for instance about a service you launched after the period.

Be careful with software supply chain questions. Customers increasingly ask for an SBOM, how vulnerabilities are triaged and how fast fixes ship. If those are covered by the report, cite it. If not, answer from your own records. A tool that generates SBOMs and matches them to known vulnerabilities, as Safeguard does, can supply the facts, but the claim in the questionnaire must match what you actually do. Safeguard does not hold or issue C5 attestations.

What to do

1. Pull the latest report and write a one paragraph cover note: edition, auditor, scope, date or period, and exceptions.
2. Ask your auditor which parts of the report you may share, and under what terms.
3. Build the topic to evidence table above, and have the owner of each area approve its row.
4. For each new questionnaire, answer from the table first, then mark what remains.
5. For gaps, write a dated, honest answer. Do not stretch the report to cover them.
6. Send the report under NDA, with the cover note.
7. Review the table every quarter, and after every major change to the service.

Quick check

Sources

• BSI: Cloud Computing Compliance Criteria Catalogue (C5), fetched 18 October 2026

Last reviewed: 18 October 2026.