What is BSI C5 and who needs a C5 attestation?
BSI C5, the Cloud Computing Compliance Criteria Catalogue, is the German Federal Office for Information Security’s (BSI) catalogue of minimum security requirements for cloud services. A cloud provider demonstrates C5 compliance through an independent audit that ends in an attestation report, called a C5-Testat, not a certificate. German federal authorities and cloud services that process statutory health data are required to use C5-attested services, and many regulated buyers ask for it in procurement.
Attestation, not certification
The BSI is explicit: “there is no certification procedure for C5. Therefore, there are no C5 certificates” (BSI C5 introduction). An auditor, usually an audit firm, examines the provider under the assurance standard ISAE 3000 (Revised) or a national equivalent such as the German IDW PS 860, and issues a report. No independent body reviews that report, so the BSI advises customers to assess its quality themselves.
There are two report types:
| Type 1 | Type 2 | |
|---|---|---|
| What the auditor checks | Whether controls are suitably designed and implemented | Design and implementation, plus whether controls operated effectively |
| Time covered | A single date | A period, at least three months, typically 6 or 12 months |
| Evidence | Documentation and walkthroughs | Samples of actual operation across the period |
| BSI guidance | Only for an initial audit, not repeated | Necessary for meaningful assurance |
Basic criteria, additional criteria and customer duties
The catalogue sorts its requirements into three groups:
- Basic criteria set the minimum security level for data with normal protection needs. All of them must be met for an attestation.
- Additional criteria address higher protection needs. In C5:2026 they are either “additional sharpen” criteria that replace a basic subcriterion with a stricter one, or “additional complement” criteria that add new aspects.
- Complementary customer criteria mark controls the customer must run, such as patching the operating system on infrastructure services. The audit report lists these complementary user entity controls. A C5 report does not cover your own part of the shared responsibility.
C5 reports also carry general information about the service: where data is processed, which certifications exist and, in C5:2026, how the provider handles investigation requests from government agencies. That makes a C5 report a source for the jurisdiction questions in data sovereignty vs data residency.
C5:2020 and C5:2026
The BSI published the C5:2026 catalogue on 7 April 2026 to replace C5:2020. Its draft was circulated in 2025 as “C5:2025”. The new version splits criteria into subcriteria and adds or reworks requirements on:
- container management
- supply chain management
- post-quantum cryptography
- confidential computing
- client separation
- technical implementation of sovereignty
It also aligns with ISO/IEC 27001:2022, the CSA Cloud Controls Matrix version 4 and the NIS2 directive, and is published in machine-readable YAML for the first time.
Audit firms describe the transition as follows (Rödl & Partner, April 2026): audit periods ending before 28 February 2027 can use C5:2020 in full, periods ending between then and 31 May 2027 can use C5:2020 if the system description documents the planned changes, and periods starting on or after 1 June 2027 must use C5:2026. Existing C5:2020 reports stay valid until they are replaced.
Who needs a C5 attestation
- German federal authorities. Under the BSI minimum standard for the use of external cloud services, federal bodies must apply C5 when they procure cloud services for official data.
- Statutory health and care data. § 393 SGB V lets doctors, hospitals, health insurers and their processors use cloud computing for social and health data only with a current C5 attestation for the cloud systems used, and only if the complementary customer criteria are implemented. Since 1 July 2025 that means a Type 2 attestation. Systems first placed on the market after 30 June 2025 can rely on a Type 1 attestation for their first 18 months.
- Regulated buyers. Banks, insurers, public bodies of the federal states and large enterprises often request a C5 report in tenders, even where no law requires it.
C5 compared with ISO 27001
| ISO/IEC 27001 | BSI C5 | |
|---|---|---|
| Scope | The information security management system of an organization | A specific cloud service |
| Result | Certificate from an accredited certification body | Attestation report from an auditor |
| Content for customers | Certificate and scope statement | Detailed description of controls, tests and exceptions |
| Customer responsibilities | Not covered | Listed as complementary customer criteria |
The two are complementary. Many providers hold both, and C5 builds on ISO/IEC 27001 controls.
Building on an attested platform
A C5 attestation covers only the service named in its report. A SaaS or Kubernetes platform running on a C5-attested infrastructure provider is not itself attested. The underlying report can support parts of the platform’s own audit, as complementary subservice organisation controls, but a buyer who needs C5 for the platform needs a report for the platform. Requirements under the EU’s NIS2 directive overlap with C5 in many areas; see what NIS2 requires from infrastructure teams. C5 is also one of the schemes behind sovereign cloud evaluations in Germany.
Cloudfleet and key control
Cloudfleet’s Confidential Control Plane on Enterprise clusters encrypts every Kubernetes object with keys held in your own HSM or cloud KMS, which organizations use to meet the key control criteria of the C5 catalogue. The Security and data protection page describes Cloudfleet’s compliance status.