BSI C5.
Understand the cloud service criteria catalogue, select the appropriate report type and clarify provider and customer responsibility.
- BSI C5:2026 · C5:2020 during transition
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
BSI C5 is an information security criteria catalogue for cloud services. An independent public auditor examines the described service and issues an attestation with an examination report. C5:2026 distinguishes point-in-time statements from additional examination of operating effectiveness over a period. Customers assess the report and their remaining security tasks themselves; the BSI issues no certificate.
BSI C5 and the cloud security criteria catalogue.
BSI C5 creates a common basis for examining and evaluating a cloud service's security commitments. Its full name is Cloud Computing Compliance Criteria Catalogue. The BSI publishes the catalogue; the provider commissions a public auditor to conduct the examination. The BSI introduction explicitly distinguishes these roles: the authority neither selects auditors nor evaluates individual reports.
The published version is C5:2026. C5:2020 remains relevant for certain examinations during transition. Edition, report type and time boundary therefore belong together when clarifying the engagement. A statement such as “C5 assessed” leaves open which service was examined under which conditions; it is insufficient for a procurement decision.
C5:2026 section 3.5 provides for the new edition for Type 1 dates from 1 June 2027 and Type 2 examination periods beginning on or after that date; earlier application is possible. Type 2 periods beginning earlier and extending beyond that date should still be examined consistently under C5:2020. For periods ending from 28 February 2027, additional information about planned control changes is already required. Agree the specific transition situation with the auditor.
Who a C5 attestation is relevant to.
Cloud providers use C5 to make security work for a defined service traceable to their customers. Customers and procurement teams receive information for their own risk assessment. A report may concern infrastructure, platforms or software; its actual scope is decisive. According to the BSI FAQ, the opinion applies to the examined services and regions, rather than every offering of a group.
Whether a C5 attestation is required depends on the particular use and applicable requirements. Examine customer contracts, procurement conditions and applicable sector-specific rules separately. An existing report also does not automatically establish suitability for information with particular protection needs. The BSI introduction assigns customers responsibility for evaluating their requirements and residual risks.
The work brought together by the C5 criteria catalogue.
C5 considers the cloud service's security organisation, operating conditions and division of tasks. The following six work areas offer practical preparation guidance; they replace neither the criteria in chapter 5 nor an agreed examination plan.
Embed responsibility in the service.
Assign decisions, operational tasks and reviews to responsible people. An organisational description should show who may act on a deviation and who tracks remediation. This avoids assuming that the coordinating security function alone performs every operational task.
Define the service and dependencies.
Describe which services, regions and supporting providers the statement covers. A technical dependency may be material to security even if contractually outsourced. Record clearly which assurances you receive from others and which tasks remain in your own operations.
Protect access and information.
Consider customer information handling throughout the actual service. A practical stocktake includes user and administrator access paths and responsibility for configuration and permissions. Also examine handovers between provider and customer; a securely operated underlying platform does not automatically answer the customer's configuration questions.
Keep operations and changes traceable.
Connect defined procedures with records of their application. A service change may affect different evidence and owners from an unchanged operating phase. During preparation, it therefore helps to place relevant changes in time and retain suitable documentation, rather than showing only today's state.
Prepare for disruptions.
Clarify responsibilities for incidents, communication and recovery. A practical exercise can reveal whether handovers and escalations work. Label exercises as such and retain their results; fictional events must not appear as historical operational evidence. The existing C5 blog covers evidence organisation in more detail.
Create transparency for customers.
C5:2026 chapter 4 describes contextual information customers need for their assessment. Communicate examination scope and remaining customer tasks so that readers can assess their own use. A general security claim is less helpful than an understandable description of the specific responsibility boundary and possible limitations.
The path to a C5 attestation.
Clarify evidence needs.
As a practical starting point, determine which customers expect a report for which service and what edition, report type and time boundary fit that need.
Describe the examination scope.
Define services, regions, participating organisations and dependencies so that the intended auditor can assess the engagement and its interfaces.
Prepare control operation.
Clarify applicable criteria and responsibilities with the relevant teams, and agree expected evidence before the intended observation period begins.
Retain operational records.
Preserve traceable evidence for the agreed time boundary and record changes and identified deviations as they actually occurred.
Arrange independent examination.
Engage a suitable public auditor and explain existing documentation without presenting later improvements as earlier control conditions.
Evaluate and maintain the report.
From the customer's perspective, examine the opinion, scope, period and limitations together, and agree continued evidence coverage for ongoing use.
What a C5 attestation demonstrates.
A C5 attestation contains the result of an independent examination of the described cloud service. Under C5:2026 section 3.4.4, Type 1 examines design and implementation at a point in time; Type 2 additionally covers operating effectiveness over a period. A point-in-time report therefore answers a different question from a report on ongoing operations.
Type 2 does not require a preceding Type 1 report. C5:2026 section 3.4.11 provides for Type 1 only for the initial examination. Which examination is appropriate depends on the engagement, starting position and evidence needs. Examine the full report and its limitations together with the system description; a cover page or provider presentation cannot replace that evaluation.
A C5 attestation has no general validity period like a certificate. It concerns the stated date or period. The BSI FAQ explains that an older report may lose relevance for today's risk assessment. New regions, significant service changes or a gap in time coverage therefore belong in the customer's current decision.
Understanding other frameworks.
ISO 27001 concerns an information security management system and its possible certification. SOC 2 is a separate reporting system with different criteria and engagement conditions. The GDPR creates statutory duties for personal data; a C5 attestation does not replace examining those duties or the controller's tasks.
In Secani.
Secani provides an editorial working aid for BSI C5:2026. Profile information records cloud providers, cloud customers, additional criteria, Type 2 coverage and subservice organisations, among other things. The catalogue supports structured work; it is neither an official translation nor an attestation. Professional evaluation and the independent examination decision remain separate tasks.
Start with a defined cloud service.
Choose a specifically named service and record customer needs. Describe the region, responsibilities and material dependencies. Then clarify with the intended auditor which edition and report type are needed for this statement. This creates a robust basis for further preparation.
Frequently asked questions.
No. The BSI publishes the criteria catalogue; an engaged public auditor produces the examination report and attestation. No BSI certificate is issued.
Type 1 examines design and implementation at a point in time. Type 2 additionally examines operating effectiveness over the stated period; a preceding Type 1 report is not required.
No blanket term can be given. The report concerns its date or period; customers must assess whether it fits current use, changes and required evidence coverage.
No. Customers must continue to assess and address tasks and risks remaining within their responsibility. This includes comparing the actual report scope with their own use.
Define the cloud service.
Discuss how you can work with the editorial C5 catalogue in Secani.
This page provides general context on C5 and replaces neither the original catalogue nor professional examination. The agreed edition, specific examination engagement and applicable requirements take precedence.