Keep monitoring after a C5 audit by turning each criterion into a recurring check with an owner, tracking every change that touches in-scope systems, and reviewing exceptions on a calendar. The report says your controls worked when examined. Customers, who are told to reread reports yearly, will judge what happens in between.
This post explains the catalogue and a monitoring routine. Safeguard holds no C5 attestation and does not provide one.
What is C5, as the regulator describes it?
The BSI, Germany's Federal Office for Information Security, says the Cloud Computing Compliance Criteria Catalogue specifies minimum requirements for secure cloud computing, aimed at professional cloud providers, their auditors and customers. It was first published in 2016. BSI says more than a hundred attestations have been granted, and that the catalogue was completely revised in 2025 and 2026.
A provider can demonstrate alignment by having public accountants or other auditors of its choice examine it. Auditors check whether criteria are met at the time of the examination and, depending on the type of engagement, whether they were also met in the past. They produce a detailed report with a system description. BSI states it is not involved in selecting auditors and does not check audit reports.
Why does monitoring matter after the report?
BSI tells customers to order the C5 report from the provider and analyse it, and to repeat that yearly. The report is a snapshot or a period record. Cloud environments change daily: new services, new engineers, new vendors. A provider that can show the same controls still operating at renewal has a stronger story than one that scrambles each year.
Note too that BSI puts shared responsibility on all three parties, providers, customers and auditors, to establish and maintain information security.
What should the routine contain?
Think in four loops, from fastest to slowest.
Continuous. Automated checks against your configuration: encryption settings, public exposure of storage, MFA enforcement, logging on, backups succeeding. Alerts go to owners, not to a shared inbox. The US NIST guide to information security continuous monitoring, SP 800-137, describes such a program as providing visibility into assets, awareness of threats and vulnerabilities and visibility into the effectiveness of deployed controls.
Per change. Link changes in code, infrastructure and vendors to the controls they might affect. A new subprocessor or a new region should trigger a review of the relevant criteria before go live.
Quarterly. Access reviews, vulnerability remediation metrics, backup restore tests, and a review of open exceptions with expiry dates.
Yearly. Risk assessment refresh, policy review, supplier review, incident exercise and a pre-audit self check against the current catalogue version, including changes in the 2026 revision.
How should software supply chain checks fit in?
Keep dated records of inventory and scan results for in-scope services: components, versions, known vulnerabilities and how fast you fixed them. When a customer asks about a widely reported flaw, the answer should come from data in hours, not memory. Tools that connect to cloud accounts and code hosts can collect many of these records on a schedule, but you still own the judgment about what counts.
What do assessors and customers notice?
Gaps in evidence between examination dates. Exceptions that never expire. Controls that exist only on the day of the audit. Keep an exceptions register with owner, reason and expiry, and close or renew each one on time.
What to do
- Map each C5 criterion in your scope to an automated check, a recurring task or a change trigger.
- Give every check an owner and an alert route that reaches a person.
- Add a compliance impact step to your change and vendor onboarding process.
- Schedule quarterly reviews for access, vulnerabilities, backups and exceptions.
- Keep an exceptions register with expiry dates.
- Store dated evidence continuously, not in a rush before audit.
- Review the catalogue revision and plan gap work before your next examination.
- Publish an annual summary for customers who reread your report.
Quick check
Does BSI review the audit reports?
No. BSI states it is not involved in selecting auditors and does not check reports. Customers draw their own conclusions.
How often should customers reread a C5 report?
BSI advises ordering and analysing the report, and repeating this yearly.
Sources
- C5 criteria catalogue, BSI, fetched 18 October 2026
- NIST SP 800-137, Information Security Continuous Monitoring, fetched 18 October 2026
Last reviewed: 18 October 2026.
