Germany C5:2020

Why does it matter?

A C5 report is how a cloud customer in Germany reads a provider's security without auditing it: the report describes the service, the provider's controls and the auditor's test results, and the BSI expects customers to request and evaluate it every year. For providers, the attestation opens public-sector procurement and, since 1 July 2024, the healthcare market under section 393 SGB V. C5:2026 keeps that model while adding the topics of the last six years.

Key benefits include:

• Minimum requirements, not best practice

C5 defines the level of information security a cloud service should not fall below, and section 5 lists the criteria auditors test.

• Basic and additional criteria

Basic criteria are mandatory for every attestation; additional criteria, classified by confidentiality or availability, extend the audit for higher customer needs (section 2.1).

• Transparency parameters

Section 4 requires statements on the system description, jurisdiction and data locations, disclosure and investigatory powers, and certifications (UP-01 to UP-04).

• Reasonable assurance by public auditors

Audits are attestation engagements with reasonable assurance under ISAE 3000 (Revised), with ISAE 3402 and IDW PS 951 applied correspondingly (section 3.2).

• Type 2 as the norm

The BSI considers a type 2 report, covering usually twelve and at least six months, necessary for a meaningful opinion; type 1 is for exceptional cases (section 3.3).

How does it work?

C5:2020 groups its criteria into 17 sections: organization of information security, security policies and work instructions, personnel, asset management, physical security, operations, identity and access management, cryptography and key management, communication security, portability and interoperability, procurement, development and modification of information systems, control and monitoring of service providers and suppliers, security incident management, business continuity management, security check and verification, compliance and data protection, and mobile device management. Each section has an objective and numbered criteria such as OIS-01 or SIM-01, and the 2020 revision added product security and the handling of government investigation requests.

The provider designs an internal control system that meets at least the basic criteria, writes a system description, and issues a written assertion on the appropriateness and effectiveness of its controls. The auditor tests the controls, with ISAE 3402 or IDW PS 951 applied for procedure and reporting, and issues a type 1 report (design at a point in time) or a type 2 report (effectiveness over a period). C5:2020 also allows a direct engagement in which the auditor prepares the system description during the audit. The report, not a certificate, is the deliverable, and it belongs to the provider.

Customers request the C5 report initially and then yearly, map the provider's controls and their own complementary user controls, and decide whether the basic criteria cover their use case or additional criteria are needed; the BSI publishes an evaluation guide and a reporting summary template for this. For transition, C5:2026 section 3.5 sets the rule: its criteria apply to type 1 engagements with reference dates on or after 1 June 2027 and to type 2 periods beginning on or after that date, earlier application is permitted, and a single engagement must not mix the two editions.

Key Elements

• 17 criteria sections (section 5)

From organization of information security to mobile device management, each with an objective and numbered basic and additional criteria.

• Surrounding parameters (section 4)

UP-01 system description, UP-02 jurisdiction and data storage, processing and backup locations, UP-03 disclosure and investigatory powers, UP-04 certifications.

• Audit standard (section 3.2)

ISAE 3000 (Revised) attestation engagement with reasonable assurance; ISAE 3402 and IDW PS 951 applied correspondingly; auditor qualification per section 3.5.1.

• Report types (section 3.3)

Type 1 on design at a date; type 2 on effectiveness over a period of usually twelve and at least six months; direct engagement option new in 2020.

• Legal pull (section 393 SGB V)

Since 1 July 2024 cloud services in German healthcare need a C5 attestation or a comparable attestation or certificate; the Federal Ministry of Health interprets the provision.

• Successor edition (C5:2026)

17 sections kept, criteria split into sub-criteria, additional criteria classed as sharpening or complementing, compatible with EUCS Substantial, with a YAML machine-readable version; applies to new audit periods from 1 June 2027.

What does it cover?

C5 addresses professional cloud providers (IaaS, PaaS and SaaS and services close to cloud), their auditors and their customers, across every industry. An attestation covers specific cloud services in specific regions, never the provider as a whole. C5:2020 is used by providers whose current audit period began before 1 June 2027 and by customers reading reports issued on it; new engagements from that date use C5:2026. Public bodies and, under section 393 SGB V, healthcare organizations are the customers for whom a C5 report is a procurement condition rather than a preference.

What are its objectives?

C5 gives cloud providers, auditors and customers one standardized basis for proving and reading cloud information security.

Set minimum information security criteria for cloud services that an attestation must cover (section 5).

Make the service's legal and operational framework transparent through the surrounding parameters (section 4).

Standardize the audit as a reasonable-assurance attestation engagement under ISAE 3000 (Revised) with type 2 reporting as the norm.

Let customers compare providers and run their own risk management on the report, repeated yearly.

Keep the catalog current through editions, with C5:2026 replacing C5:2020 for audit periods from 1 June 2027.

Framework in Context

C5 is the German counterpart of a SOC 2 report for cloud providers and is built on ISO/IEC 27001 and the other standards in its cross-reference table; the BSI publishes mappings of C5 to international standards and to ISO/IEC 27001:2022. C5:2020 served as the basis for the Substantial level of the planned European cloud certification scheme (EUCS), and the BSI built C5:2026 on that work plus CSA CCM v4, ISO/IEC 27001:2022 and NIS2. In France, SecNumCloud plays the trust-label role for cloud providers; in German healthcare, section 393 SGB V ties procurement to the C5 attestation.

Common Framework Mappings

The BSI publishes cross-reference tables from C5 to international standards and to ISO/IEC 27001:2022, so providers map the catalog to the frameworks below to reuse audit evidence across reports.

Mapped frameworks include:

CSA CCM v4

GDPR

ISO 27001:2022

ISO 27002:2022

ISO 27017

ISO 27018

ISO 27701

NIST 800-53 Rev.5