C5, the Cloud Computing Compliance Criteria Catalogue from Germany's Federal Office for Information Security (BSI), sets minimum requirements for secure cloud services. An auditor examines whether a provider meets the criteria and writes a report. The evidence they ask for is what proves each control exists, operates and is monitored.
What is C5 and who uses it?
According to BSI, C5 was first published in 2016 and specifies minimum requirements for secure cloud computing, aimed at professional cloud providers, their auditors and customers. BSI says over a hundred attestations have been granted for national, European and global providers, and that C5 was completely revised in 2025 and 2026. Its versions are listed as C5:2026 and C5:2020.
BSI explains the model. A provider can mandate certified public accountants or other auditors of its choice to examine it. Auditors check whether criteria are met at the time of the examination and, depending on the engagement type, whether they were met in the past. They write a detailed report with a system description. BSI does not select auditors and does not check audit reports. Customers are expected to obtain the report, analyze it in their own risk assessment, and repeat that yearly.
This article explains the framework. It is not a statement that any particular company holds a C5 attestation.
What evidence do auditors ask for?
BSI's page does not list the evidence items, so we describe the typical pattern of any criteria based examination rather than quoting a catalogue. Check the C5 text for exact criteria numbers. Auditors generally want four kinds of proof.
Documents. Policies and procedures that state what you do: access control, change management, incident handling, supplier management, business continuity. They must be approved, dated and current.
Records. Proof the procedures run: tickets for approved changes, access review sign offs, incident reports, training completion, restore tests.
System evidence. Configuration exports, logs and screenshots showing controls are enabled: encryption settings, role assignments, backup schedules, monitoring alerts. Auditors may sample across the period.
People and inquiry. Interviews with the staff who operate controls, to confirm practice matches paper.
For a Type 2 style examination across a period, sampling dates and population completeness matter. If you cannot list every change made in the period, the auditor cannot sample properly.
Where do software supply chain controls fit?
A cloud provider's change management, vulnerability management and supplier management criteria will touch how you build and ship software. Expect questions on how dependencies are inventoried, how known vulnerabilities are prioritized and fixed, how builds are protected, and how subservice providers are assessed. Dated scan results, SBOMs per release and fix records are straightforward evidence for those.
What to do
- Download the current C5 catalogue from BSI and decide which version your customers expect.
- Map each criterion to a policy, an owner and an evidence source.
- Automate evidence collection where you can, with timestamps and hashes.
- Run an internal dry run: pick ten criteria and try to produce evidence in an hour.
- Make sure you can list the full population for sampling: changes, users, incidents.
- Keep a clear description of the system and its boundaries, since the report includes one.
- Plan for yearly repetition, as BSI notes customers should re-analyze reports each year.
Quick check
Does BSI certify cloud providers for C5?
According to BSI, attestation is given by auditors the provider engages. BSI does not choose auditors or check the reports.
Should a customer just accept a C5 report?
No. BSI says customers must analyze the report in their own risk assessment and decide whether the baseline is enough for their use case.
Sources
Last reviewed: 18 October 2026.
