C5 glossary: 14 terms from BSI's cloud catalogue in plain language

C5 is the Cloud Computing Compliance Criteria Catalogue published by Germany's Federal Office for Information Security (BSI). It sets minimum security criteria for cloud services, and an independent auditor reports on whether a provider meets them. This glossary explains the terms you meet when you read a C5 report.

Safeguard does not hold a C5 report. This is an explainer for buyers and providers.

The basics

C5. The catalogue itself. The BSI first published it in 2016 for professional cloud providers, their auditors and their customers. It was completely revised in 2025 and 2026.

BSI. Germany's Federal Office for Information Security. It owns the catalogue. It does not select auditors and does not check audit reports.

Criteria. The individual requirements a provider is tested against. The catalogue groups them into domains.

Domain. A topic area. The earlier edition's table of contents includes organisation of information security, asset management, physical security, operations, identity and access management, cryptography and key management, communication security, incident management and business continuity.

Cloud service provider. The organisation whose service is audited. The audit covers a defined service named in the system description.

Cloud customer. The organisation using the service. The BSI advises customers to obtain the report from the provider, analyse it and repeat that every year.

The audit

Auditor. The provider chooses a certified public accountant or other auditor. The BSI has separate requirements for auditor qualification.

ISAE 3000 (Revised). The international assurance standard the catalogue names as the basis for the audit.

System description. The provider's written account of the service: its type and scope, and the principles, procedures and measures used to provide it. The auditor checks that it matches reality.

Type 1 report. Looks at whether the system description reflects the actual design and whether controls are designed appropriately at a point in time. Suitable for a new service. The BSI says it should not be repeated several times in a row.

Type 2 report. Adds testing of whether controls worked. The audit period usually covers twelve months and not less than six.

Exception. A criterion the provider does not meet, or meets only in part. The catalogue has a section on how existing or identified exceptions are reported.

The 2026 changes

Basic and additional criteria. Basic criteria are the baseline. In the revised edition, additional criteria are described as either sharpening a basic criterion or complementing the catalogue with new requirements.

C5:2026. The revised edition that replaces C5:2020. Rödl reports it is mandatory for C5 audits from 1 June 2027, with a transition phase for audits concluding from 28 February to 31 May 2027, and that existing C5:2020 attestations remain valid. Check dates with your auditor.

How do you read a report quickly?

Look at six things in order. The service name and scope. The audit period. The type, 1 or 2. The list of exceptions. The subservice providers named. The date of the report.

An old report, a short audit period or a narrow service scope tells you as much as any control result.

What to do

1. Ask your cloud provider for its C5 report and note the edition.
2. Check the service in the report is the service you use.
3. Read the exceptions section before the controls.
4. Record the audit period and set a reminder for the next report.
5. If you are a provider, write your system description in plain language and keep it current.

Quick check

Sources

• BSI: Cloud Computing Compliance Criteria Catalogue C5
• BSI: C5 catalogue PDF (earlier edition)
• Rödl and Partner: C5:2026 (8 April 2026)
• Schellman: updates to Germany's BSI C5 standard

Last reviewed: 18 October 2026.