C5, the Cloud Computing Compliance Criteria Catalogue, is a list of minimum security requirements for cloud services published by Germany's Federal Office for Information Security (BSI). Cloud providers, their auditors and their customers use it. You need it when German buyers ask for evidence that your cloud service meets it.
What exactly is C5?
BSI first published C5 in 2016. Its own page says it specifies minimum requirements for secure cloud computing. It is a catalogue of criteria, not a product and not a certificate you buy from BSI.
The page also says C5 was completely revised in 2025 and 2026 to reflect recent developments. It links to both a 2026 and a 2020 edition, and the labels on the page do not make clear which one is current for a given audit. That is a practical warning: before you plan an engagement, ask your auditor and the customer which edition applies.
How do you prove you meet it?
Through an independent audit. BSI describes the audit report as showing whether the criteria are met at the time of the investigation, and the report includes a description of the system. Customers use these standardized reports to compare providers and to base their own risk assessments.
Notice two things in that description. The report is a snapshot, so a customer reading it later should look at the date and the period it covers. And the system description sets the boundary, so a clean report for one service says nothing about another service from the same company.
Who needs it?
BSI names three groups: professional cloud service providers, their auditors and their customers. In practice the pull comes from the customer side.
- Cloud and SaaS providers selling into Germany get asked for a C5 report in vendor reviews, tenders and security questionnaires.
- Customers in regulated or public sectors use the reports to assess the providers they depend on.
- Auditors perform the examination and write the report.
Some secondary sources claim C5 is mandatory for German federal cloud procurement or accepted in financial sector outsourcing reviews. We could not confirm those from a BSI page, so confirm the rule that applies to your contract before treating it as a requirement.
Is it a certification?
BSI's page does not describe C5 as a certification, and the audit is an examination by an independent auditor. Be careful with wording in your own materials. Say that a provider "has a C5 report" when an auditor has issued one, and name the edition, scope and date.
How does it compare with other frameworks?
C5 is cloud specific. It is often discussed next to ISO 27001 and SOC 2 because customers ask for all three. We did not fetch the C5 control mapping, so this post does not state which criteria overlap. If you already hold an audit report under another framework, ask your C5 auditor how much evidence carries across.
What to do
- Find out who is asking. Get the customer's wording: which edition, which service, and whether a report or just answers are needed.
- Check which edition of C5 applies, using BSI's page and your auditor.
- Define the scope: one service or several, regions, and subcontractors.
- Inventory the evidence you already have, such as policies, access reviews, logs and change records.
- Run an internal gap review against the criteria before you pay for an audit.
- Pick an auditor and agree the period the report will cover.
- Plan for repeat reports, since a report is a snapshot and customers want a current one.
Software supply chain evidence, such as an SBOM and vulnerability handling records, is typically part of what auditors and customers ask to see for a cloud service you build. Safeguard's compliance automation can help organize such evidence, but Safeguard does not issue or hold C5 attestations, and using a tool does not make you compliant.
Quick check
Is there a C5 certificate from BSI?
BSI publishes the catalogue. Proof comes from an independent audit report, per BSI's description. Do not describe it as a BSI certificate.
Does a C5 report cover my whole company?
No. It covers the system described in the report, for the date or period it states.
Sources
- BSI: Cloud Computing Compliance Criteria Catalogue (C5), fetched 18 October 2026
Last reviewed: 18 October 2026.
