A BSI C5 attestation costs whatever your scope, report type, control maturity and chosen auditor add up to, and it takes as long as your gaps take to close plus an observation period for Type 2. No public price list exists, so ask auditors for quotes against a written scope.
What is C5, and who checks it?
C5 stands for Cloud Computing Compliance Criteria Catalogue. Germany's Federal Office for Information Security (BSI) publishes it and describes it as specifying minimum requirements for secure cloud computing. It was first published in 2016.
The detail that shapes cost is who does the checking. According to the BSI, a provider can mandate certified public accountants or other auditors of its choice to examine the service. The auditors write a detailed examination report. The BSI is not involved in choosing auditors and does not check the reports.
So there is no BSI fee to budget. Your spend goes to your own preparation and to the auditor you hire.
Which catalogue version applies?
The BSI page says C5 was completely revised in 2025/26 and links both C5:2026 and C5:2020. One audit firm's summary says C5:2026 appeared in April 2026, grows the catalogue from 121 to 168 criteria across 17 domains, and becomes mandatory for audit periods that begin on or after 1 June 2027, with C5:2020 usable until then. That summary comes from a firm that sells attestation services, and we could not confirm the dates on the BSI page. Treat them as a lead, and check the transition rules with your auditor before you plan.
If you are starting now, the version question can move your timeline by months. Decide it first.
What actually drives cost?
Think of six levers.
Scope. Which cloud services, regions, data centers and subservice providers are inside the report? A narrow, well defined service is cheaper to examine than a platform spread over many teams. Write the system description early, because every later estimate depends on it.
Type 1 or Type 2. Audit firms describe Type 1 as a check that controls are suitably designed at a point in time, and Type 2 as adding proof that they operated effectively over a review period. Type 2 means more testing and more evidence. The same firm says Type 2 is what most regulated buyers expect, but gives no source for it, so ask your own prospects what they will accept.
Starting point. If you already run an ISO 27001 or SOC 2 style program, much of the evidence exists. The audit firm notes that existing SOC 2 work can be reused for evidence collection, but also warns against assuming a like for like carryover. Expect gaps in areas the new catalogue tightens, such as subcontractor management and identity and access management.
Evidence quality. Auditors sample. If your evidence is screenshots collected the week before fieldwork, you will pay for rework. If it flows from systems automatically, sampling is calmer and cheaper.
Auditor choice. Because the BSI leaves the choice to you, quotes will differ in method, team size and how they handle your questions. Compare scope statements, not just totals.
Remediation. The largest line is often your own engineering time to fix what a gap assessment finds, not the audit fee itself.
How long does it take?
No source I fetched gives a standard duration, and I will not invent one. Break it into phases you can estimate yourself:
- Gap assessment against the catalogue version you will be audited on.
- Remediation of the gaps. This is the part you control.
- For Type 2, an observation period. Audit firms commonly describe it as months long, so confirm the length your auditor will accept.
- Fieldwork and report writing.
The observation period is the one piece that money cannot compress. Starting evidence collection early is the cheapest schedule insurance.
What to do
- Write a one page scope: services, regions, subservice providers, data types.
- Confirm with your auditor whether you will be examined against C5:2020 or C5:2026.
- Decide Type 1 first or Type 2 straight away, based on what your buyers ask for.
- Run a gap assessment before you ask for fixed price quotes.
- Map existing controls from other frameworks to C5 so you reuse evidence.
- Automate evidence collection for access reviews, change records and vulnerability handling.
- Get at least two quotes against the same written scope.
For the software side, an up to date dependency inventory and a record of how vulnerabilities are found and fixed are the kind of evidence that auditors ask for. Safeguard offers compliance automation and SBOM generation that can help you gather it. C5 itself is an audit outcome from an independent auditor, and no tool can issue it for you.
Quick check
Does the BSI issue the C5 attestation?
No. According to the BSI, providers mandate auditors of their choice, and the BSI does not select auditors or check their reports.
Is there a standard price for C5?
No public price list was found. Cost follows scope, report type, existing controls and the auditor, so get quotes against a written scope.
Which catalogue version should I prepare for?
Ask your auditor. The BSI lists both C5:2026 and C5:2020, and transition dates reported by third parties should be confirmed with the BSI or your auditor.
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue (C5), fetched 18 October 2026
- A-LIGN: C5:2026 attestation guide, a vendor article, used only for the points marked above
Last reviewed: 18 October 2026.
