Nobody publishes a ranked list of the most common C5 audit findings, and we did not find one. What the audit design shows is where proof is hard: controls that did not run for the whole audit period, a system description that does not match reality, and exceptions found late. This post explains each and how to prepare.
C5 is the Cloud Computing Compliance Criteria Catalogue from Germany's BSI. Safeguard does not hold a C5 report. This is an explainer, and the points below are our reading of the BSI documents, not statistics.
What does a C5 audit actually test?
The BSI says the provider picks the auditors, certified public accountants or other auditors, and the BSI is not involved in choosing them and does not review the reports. Auditors check whether criteria are met at the time of the examination and, depending on the engagement, whether they were met in the past. Customers are told to request the report from the provider, analyse it and repeat that yearly.
The catalogue's earlier edition separates two report types. A Type 1 report asks whether the system description reflects the real design and whether controls are designed appropriately at one point in time. A Type 2 report adds tests of whether controls were effective. Its audit period usually covers twelve months and not less than six. The BSI says Type 1 should be used only in exceptional cases, such as a new service, and not several times in a row.
Where does proof get hard?
Controls that exist but did not run all period. A Type 2 audit tests operation over time. A vulnerability review that happened twice in a year, an access recertification skipped in one quarter, or a restore test that ran only after the audit began will each produce a gap. Evidence needs dates across the whole period.
A system description that drifted. The auditor compares the description of your service with what is running. New regions, new subservice providers or a migrated key management setup make the description stale. Update it when the system changes, not before the audit.
Exceptions found late. The catalogue has a section on reporting existing or identified exceptions to requirements. An exception that you declare with a remediation plan reads very differently from one an auditor finds.
Dependence on other providers. If your service relies on a cloud platform or other suppliers, you must show how you monitor them. Domains in the catalogue include control and monitoring of service providers and suppliers, security incident management and business continuity management.
Software and change control. The catalogue covers procurement, development and maintenance. Evidence of how you track open source components, review changes and handle vulnerabilities across the period is a common ask in any audit of this kind.
What changes with C5:2026?
BSI describes C5 as completely revised in 2025 and 2026. Reporting on the revision says the new edition replaces C5:2020, that criteria are broken into more individual sub-criteria aligned with the EU cloud certification scheme, and that additional criteria are labelled as sharpening a basic criterion or complementing the catalogue. Rödl reports that C5:2026 becomes mandatory for all C5 audits from 1 June 2027, with a transition phase for audits concluding between 28 February and 31 May 2027, and that existing C5:2020 attestations stay valid. Confirm these dates with BSI and your auditor.
What to do
- Decide whether you need a Type 2 report and plan an audit period of at least six months, ideally twelve.
- Build an evidence calendar: for each control, what is produced, how often and where it is stored.
- Run a mock review at month three and fix gaps while the period is still open.
- Rewrite the system description whenever the architecture, regions or subservice providers change.
- Decide in advance how you will disclose an exception, with an owner and a date for remediation.
- Ask your auditor which edition applies to your audit window.
Quick check
How long is a C5 Type 2 audit period?
The BSI says it usually covers twelve months and not less than six. Shorter periods can be accepted in exceptional cases and must be justified in the report.
Does the BSI review the audit reports?
No. The BSI states that it is not involved in selecting auditors and does not check the audit reports. Customers are expected to analyse the report themselves.
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue C5
- BSI: C5 catalogue PDF (earlier edition)
- Rödl and Partner: C5:2026 (8 April 2026)
- Schellman: updates to Germany's BSI C5 standard
Last reviewed: 18 October 2026.
