C5 audit evidence: what to automate and what to keep manual

For a BSI C5 examination, automate evidence that repeats and can be exported on a schedule: configurations, access lists, change records, scan results and log retention settings. Keep judgment calls manual: risk decisions, exceptions and management review. Automation gives the auditor dated, consistent proof. It does not make a control exist.

What is C5 evidence for?

C5 is the Cloud Computing Compliance Criteria Catalogue from Germany's BSI, which describes it as a criteria catalogue setting a baseline security level for cloud services. The BSI says customers use the standardized audit reports as a basis for their own risk analysis. The BSI does not select auditors or check their reports.

Per the BSI page, a provider can mandate certified public accountants or other auditors of its choice to examine the service. Auditors check whether criteria are met at the time of the examination and, depending on the engagement, whether they were met in the past. The resulting report includes a system description of the provider's procedures and measures. The BSI page also says the catalogue was completely revised in 2025/26 and links both C5:2026 and C5:2020. Confirm with your auditor which version your engagement uses.

An engagement that looks back over a period needs evidence from the whole period, not a screenshot taken last week. That is where automation earns its keep.

What should you automate?

Anything the same each time you ask:

• Access. Exports of users and roles for in-scope systems, with dates, and records showing leavers lost access.
• Configuration. Snapshots of settings such as encryption, logging and network rules, taken on a schedule, with changes diffed.
• Change management. Pull requests, approvals, test results and deployment records linked to tickets.
• Vulnerability management. Scan results over time, with ticket status and fix dates.
• Software inventory. A current list of components and versions in the service.
• Logging and monitoring. Retention settings and proof alerts are routed and acknowledged.
• Backups and recovery. Job results and the dates of restore tests.

Store each export with a timestamp and the system it came from, in a place the auditor can read and nobody can quietly edit.

What should stay manual?

• Risk decisions. Why you accepted a risk, who approved it and when you will revisit it.
• Exceptions. A document with a reason, an owner and an end date.
• Management review. Minutes that show people actually read the reports.
• The system description. Written by someone who understands the service, kept current.
• Incident handling. The story of a real event, with lessons.

How does a platform help?

Safeguard offers compliance automation and maps findings and controls to frameworks, which can reduce the manual gathering of dependency, vulnerability and inventory evidence. It does not hold or give you any attestation, and it does not decide whether you meet a criterion. Only your auditor can. Try the framework mapping view below to see how evidence lines up with controls.

Open the full version at /demos/framework-mapping.

What to do

1. Get the written scope and the catalogue version from your auditor.
2. List every criterion that needs evidence and tag each as automatable or manual.
3. For automatable items, schedule exports and store them with timestamps.
4. Write owners and review dates for the manual items.
5. Run a mock request: ask an engineer to produce evidence for five random items in an hour.
6. Fix the slowest five and repeat before the real engagement.

Quick check

Sources

• BSI: Cloud Computing Compliance Criteria Catalogue (C5)

Last reviewed: 18 October 2026.