BSI C5

The Cloud Computing Compliance Criteria Catalogue (C5) is the German Federal Office for Information Security's (BSI) standard for demonstrating the information security of cloud services.

The current edition, C5:2020, contains 121 criteria in 17 domains (organization of information security, personnel, asset management, physical security, operations, identity and access, cryptography, communications security, portability and interoperability, procurement and development, supplier management, incident management, business continuity, compliance, dealing with investigation requests, and product safety and security), split into basic criteria and optional additional criteria for higher assurance.

It also requires the provider to publish system description information about jurisdiction, data location, subcontractors, and government access so that customers can judge the environment.

C5 is widely required in German public sector procurement and, since a 2024 legal change, is referenced for cloud services processing health data under SGB V (verify the current statutory wording).

C5 is an attestation, not a certificate. An independent auditor examines the provider's controls against the criteria under the ISAE 3000 assurance standard (or the equivalent German IDW PS 860) and issues a Type 1 report (design at a point in time) or Type 2 report (design and operating effectiveness over a period, usually six to twelve months).

In writing, the provider needs a system description, a control matrix mapping each C5 criterion to its controls and owners, policies and procedures for each domain, the environmental disclosures required by the catalog, and operating evidence for the period. Many providers combine the C5 examination with SOC 2 in a single audit.