BSI C5 (Cloud Computing Compliance Criteria Catalogue)
German minimum security criteria for cloud services, examined by an auditor under ISAE 3000 and reported to customers; relevant to data centre operators that sell cloud or managed services to German public bodies and health care.
- 5requirementsin our own words
- 2editions C5:2020
- 1places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is a duty in 1 of 30 places, voluntary in 29 more. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| Austria, Belgium, Bulgaria, Switzerland, Cyprus, Czechia, Denmark, Estonia, Spain, Finland, France, United Kingdom, Greece, Croatia, Hungary, Ireland, Italy, Lithuania, Luxembourg, Latvia, Malta, Netherlands, Norway, Poland, Portugal, Romania, Sweden, Slovenia, Slovakia | Applies | Voluntary In force | None stated Used outside Germany by customers who sell to German public bodies or health care. | Not stated |
| Germany | Applies | Required by law In force | Sector: health sector cloud users; public sector Section 393 SGB V requires a C5 attestation or comparable certificate for cloud use in the health sector; German public tenders also ask for C5. | Federal Ministry of Health interprets §393 SGB V; BSI publishes C5 |
What it asks for
5 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Choose the cloud services and regions to audit; the attestation covers those only. | Scope definition Record, checked by document review | Compliance manager | Every year Governance, a system or service |
| Meet the basic criteria of the catalogue for the services in scope. | Control matrix Record, checked by document review | Security lead | Continuous Governance, a system or service |
| Obtain an ISAE 3000 based attestation from an auditor and choose Type 1 or Type 2. | Attestation report Record, checked by document review | Compliance manager | Every year Contractual, the organisation |
| Give customers the report and define complementary controls they must run. | Customer-facing responsibility matrix Contract, checked by document review | Compliance manager | Every year Contractual, a system or service |
| Plan the move to C5:2026: it applies to Type 2 periods beginning on or after 1 June 2027 and to Type 1 reports dated after that day. | Transition plan Record, checked by document review | Compliance manager | Once Governance, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| C5:2026 | Adopted, not yet in force Final version published by end of March 2026 per the BSI C5:2026 page; mandatory application from 1 June 2027. Two BSI pages differ in wording and both were read on 18 Oct 2026: the FAQ applies C5:2026 to Type 2 periods beginning on or after 1 June 2027 (and Type 1 dates after it); the current-version page recommends it for test periods ending on or after that day. | Mar 2026 | 1 Jun 2027 Transition until 1 Jun 2027 | C5:2020 |
| C5:2020 | Current BSI recommends C5:2020 for test periods ending on or after 15 Feb 2021 and C5:2026 for test periods ending on or after 1 June 2027. | Jan 2020 | Not stated | None named |
Stages, levels and report types
What each one is, how long it is valid, and the claim you may make once you hold it.
| Stage or level | Report or award | Period and validity | What you may say |
|---|---|---|---|
| Type 1 | attestation report (ISAE 3000 based) | as of a specified datecustomers should analyse a fresh report yearly | Say: C5 Type 1 attestation as of DATE. BSI does not issue or check the reports. |
| Type 2 | attestation report (ISAE 3000 based) | specified periodscustomers should analyse a fresh report yearly | Say: C5 Type 2 attestation for the period FROM-TO. |
About the programme
- Assessed by
- An independent auditor
- Scope
- cloud service in defined regions
- Levels
- Type 1 (at a date) and Type 2 (over a period) attestation
- Validity
- BSI says customers should order and analyse the C5 report yearly.
- Accreditation route
- none: auditors (for example public accountants) are chosen by the provider; BSI is not involved
- Regulator
- BSI publishes the criteria but does not select auditors or check reports
- Who asks for it
- Public tenders, Health-data customers, Regulator, Wholesale and hyperscale customers
- Where it is used
- DE (primary), used across Europe
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.