BSI C5:2026: What the New Cloud Criteria Catalogue Means for Providers and Customers

If you buy or sell cloud services, you can hardly avoid C5, and since 2026 there is a new benchmark. The BSI's Cloud Computing Compliance Criteria Catalogue has been thoroughly revised after six years, and the transition period for attestations is already running. This article explains what changes, when you have to switch, and how to read a C5 attestation correctly as a customer.

What is BSI C5 and why does the attestation carry weight?

C5 stands for Cloud Computing Compliance Criteria Catalogue. The German Federal Office for Information Security (BSI) first published it in 2016 and updated it in 2020. It sets minimum requirements for the information security of cloud services, organized by topics such as personnel, physical security, or cryptography.

The audit works differently from ISO 27001. There is no certificate from a certification body. Instead there is an attestation: an auditor confirms in a report whether the cloud provider meets the criteria for its service. The report describes the service, the controls, the audit procedures, and the result. In the BSI's words, auditors attest after a successful audit that a cloud provider meets the security criteria of C5.

Why does this matter to you even though C5 is not legally required everywhere? Because customers use it as a common language. Instead of sending every provider the same long questionnaire, buyers ask to see the audit report. It is requested particularly often by public authorities and in healthcare. For providers, a missing current attestation quickly becomes a sales blocker there.

This article looks at both sides. If you offer SaaS, hosting, or managed services, you care mainly about the path to an attestation under C5:2026. If you select cloud services, you care about reading the report to see what it actually proves.

What is new in C5:2026?

The BSI first published C5:2026 as a community draft and released the final English version in March 2026. The press release followed on April 7, 2026. The German version came out on August 12, 2026. What matters for you is less the publication date than the cut-off for application, and that one is clear (more on this shortly).

The revision brings four things: more criteria, a new structure, new topics, and a technical change in format.

Basic criteria and additional criteria

The structure sounds dry but has practical consequences. Basic criteria are mandatory for every C5 attestation. Additional criteria do not apply automatically; whether they are included depends on customer requirements, regulatory obligations, and the desired security level, among other things. The BSI distinguishes two kinds: "additional sharpen" tightens a basic criterion, "additional complement" adds new requirements to it.

As a customer, you should therefore check in the report whether the provider was audited against only the basic criteria or also against additional ones. As a provider, it is worth asking which additional criteria your most important customers expect before you fix the audit scope.

Containers, supply chain, cryptography, and confidential computing

Container management is the answer to the reality of modern cloud architectures. If you run your application on Kubernetes, you have to show how images are checked, clusters hardened, and workloads separated. Supply chain management targets the question of how a provider monitors its own subservice providers and verifies their security obligations. How you set this up on the customer side is covered in the article on supplier assessment with security questionnaires.

In cryptography, the BSI explicitly includes post-quantum methods for the first time. In practice that means providers need a crypto inventory to even be able to say where which methods are in use and what has to be replaced later. Confidential computing protects data while it is being processed in memory, for example through hardware-based isolated execution environments. It is not a must for every service, but the catalogue now regulates how it is audited when a provider advertises it.

What role does digital sovereignty play?

The BSI has worked out tenant separation and technical sovereignty more specifically. The aim is for customers to be able to make informed, independent decisions about cloud use. In its April 7 press release the BSI also announced that it would publish general sovereignty criteria for cloud solutions shortly. Whether they are out by now is best checked on the BSI's C5 page. How far the concept carries in practice is shown in the article on digital sovereignty for SMEs.

Until when does C5:2026 apply? Cut-off dates and transition

The first question providers ask: do we have to switch right now? No, but the transition period is shorter than it looks. The BSI's FAQ states that C5:2026 applies to all attestations from June 1, 2027, as follows:

• Type 1 reports: The reference date of the report is June 1, 2027 or later.
• Type 2 reports: The audit period begins on or after June 1, 2027.
• Earlier application: Possible and expressly permitted.
• Transition rule: If the reference date (Type 1) or the end of the audit period (Type 2) falls on or after February 28, 2027 but before June 1, 2027, the provider must give additional information about the planned changes in the system description. According to Rödl & Partner this covers the affected criteria, the planned adjustments, the implementation status, and the implementation date.

A report may not mix standards: each engagement applies either C5:2020 or C5:2026.

Worked example for a provider

Take a SaaS provider with about 100 employees whose Type 2 audit period runs from July 1 to June 30 every year. The period from July 1, 2026 to June 30, 2027 starts before June 1, 2027, so it stays under C5:2020. It ends after February 28, 2027, so the system description has to name the planned changes. Only the period that starts on July 1, 2027 is a C5:2026 report. The switch therefore has to be in operation by mid-2027. If you introduce the new controls only in July 2027, you will have deviations in the report for the first C5:2026 audit period.

This is a worked example, not a statement about any particular provider. You set your own schedule together with your auditor.

C5:2026 for providers: How to approach the switch

For SaaS, hosting, and MSP providers the task is: gap analysis, measures, evidence, audit period. The order determines the effort.

Step 1: Define the scope and additional criteria

A C5 attestation never covers the whole company, only a service, the service scope. Decide which services, locations, and subservice providers are in scope. Then decide which additional criteria you include. The best way to answer the question of what your customers need is through sales: which tenders and customer requirements came in over the last year, and what did they say about C5?

Step 2: Gap analysis against the 168 criteria

Compare your current state with the new catalogue. If you already run an ISMS under ISO 27001:2022, a large part is covered, because according to the BSI, C5:2026 takes into account ISO/IEC 27001:2022, NIS2, and the Cloud Security Alliance's Cloud Controls Matrix v4. The gaps are typically in the cloud-specific topics: containers, tenant separation, data locations, subservice provider monitoring, and cryptography. Thanks to the YAML version you can, for the first time, import the criteria into your control system automatically instead of retyping them from the PDF.

Step 3: Work through the new topics

Plan concrete measures for the four new focus areas:

• Containers: image scanning, cluster hardening, workload separation, a patch process for base images.
• Supply chain: a list of subservice providers, an assessment per subservice provider, contractual security requirements, re-assessment.
• Cryptography: an inventory of the methods and keys in use, a plan for migrating to post-quantum methods.
• Confidential computing: a decision on whether you offer it or deliberately do not, and documentation of that decision.

Step 4: Write the system description and complementary user entity controls

The system description is the heart of the report. It states what your service does, how it is built, which subservice providers are involved, and what lies within the customer's responsibility. These customer duties are called complementary user entity controls (CUEC). If you word them sloppily, your customers end up with gaps they cannot see. If you word them precisely, your report is more credible.

Step 5: Type 1 or Type 2, and when?

A Type 1 report examines whether the controls are suitably designed at a reference date. A Type 2 report additionally examines whether they were effective over a period. According to consultancy accounts, Type 1 is intended for initial audits and follow-up audits are then Type 2, with a minimum of three months for the Type 2 period and up to twelve recommended. So plan so that you do not need the attestation only when a customer asks for it. A Type 2 audit period cannot be backdated.

Step 6: Involve the auditor early

C5 audits are carried out by public auditors (Wirtschaftsprüfer). C5:2026 also admits auditors without that title if they meet equivalent professional, legal, and quality requirements. Section 3.4.2 of the catalogue describes the qualification of the audit team. Talk before the start about scope, additional criteria, schedule, and the transition rule so that nothing surprises you during the audit period.

You collect the evidence itself, from the subservice provider contract to the log of the last container hardening, more conveniently in a tool where measures, service providers, and audit results come together. In ISMS Lite you store it as evidence on the respective service provider or measure, so the auditor does not have to piece it together from five folders.

Reading a C5 attestation: What customers have to check

Now the customer side. A provider sends you its C5 attestation. The fact that it exists says little. The value is in the detail, and you read it in this order.

Type 1 or Type 2?

Type 2 carries more weight because it proves effectiveness over a period. A Type 1 report is fine for a young product, but for an established provider you should ask for the Type 2 report. Note which type you receive and set a date for requesting the next report.

Which scope was audited?

This is the most common stumbling block. A provider can hold a C5 attestation for service A while you use service B. The company is the same, but the product, and with it the scope, is not. Check whether the service you are ordering appears in the system description, and likewise the locations and regions where your data is stored. The attestation does not, however, tell you which legal system can reach the provider, for example when a parent company sits outside the EU. You clarify that question separately.

Which period and which version?

For Type 2, the audit period tells you how current the evidence is. A report that ended 14 months ago does not prove how the provider works today. Also check which version of the catalogue was used. Until the cut-off on June 1, 2027, C5:2020 reports are normal, after that C5:2026 reports will appear. An older report is not automatically bad, but you need to know which requirements it does not cover, such as container management and supply chain.

Which criteria were included?

Check whether only basic criteria or also additional criteria were audited, and whether criteria relevant to your use case were marked not applicable. The report should give reasons for why a criterion does not apply.

What do the deviations say?

The audit result is not pass or fail but a statement with qualifications. Read the sections on deviations and exceptions carefully. A deviation in a tenant separation criterion weighs differently than one in training documentation. Ask the provider whether the deviation has been fixed since, and record the answer.

What do you have to do yourself as a customer?

The complementary user entity controls (CUEC) are the tasks the provider deliberately leaves with you: user management, permission assignment, multi-factor authentication for your accounts, classification of the data you upload. If you put the attestation in a drawer and do not implement the CUEC, you have gained no protection, only a piece of paper. Turn each CUEC into its own measure with an owner. This fits the shared responsibility model, which C5:2026 works out more strongly.

How do you deal with subservice providers in the report?

Cloud providers often use hyperscalers or data center operators themselves. The report states whether these subservice providers were included, or whether the auditor carves out their controls and the provider merely describes what it expects of them. In the second case you need separate evidence for the subservice provider or have to assess the gap yourself.

C5 vs. ISO 27001, SOC 2, and EUCS: Which evidence for what?

The question comes up in every procurement conversation: is ISO 27001 enough, or do we need C5? The answer depends on what the evidence actually proves.

C5 and ISO 27001

ISO 27001 examines whether a company operates a management system. C5 examines whether a specific cloud service meets concrete security criteria, including the division of responsibility between provider and customer. The two complement each other. An ISO 27001 certificate is a good basis for C5 but does not replace it, because the catalogue contains cloud-specific requirements that ISO 27001 does not name. Conversely, a C5 attestation does not replace the ISMS in your own house. The control for how you use cloud services is in ISO 27001 A.5.23.

C5 and SOC 2

SOC 2 is the US counterpart, an audit of service organizations against AICPA criteria with the distinction between Type I and Type II. If you have US customers, you will be asked about SOC 2; if you supply German authorities or healthcare operators, you will be asked about C5. Many providers have both audited because controls and evidence overlap. Still expect separate audit engagements.

C5 and EUCS

C5:2020 was the basis for developing the planned EUCS level Substantial, and according to the BSI, C5:2026 is closely aligned in content and structure with the results of the EUCS work. That does not mean EUCS applies yet. As of October 2026, the European cloud certification scheme EUCS has not been adopted by implementing act. The political debate centers on sovereignty requirements at the highest level, and the Commission's January 2026 proposal for a Cybersecurity Act 2 takes up the topic again. For your planning that means: do not rely on EUCS, rely on C5, ISO 27001, and where applicable SOC 2.

C5 and the NIS2 supply chain

If you fall under NIS2, you have to reflect the security of your supply chain in your risk management. In Article 21(2)(d), the directive names supply chain security, including security-related aspects of the relationships between each entity and its direct suppliers or service providers. Under paragraph 3, the specific vulnerabilities of each supplier and the overall quality of their products and cybersecurity practices have to be taken into account.

How does a C5 attestation help? It provides independently audited evidence for an important cloud service provider, and because C5:2026 took NIS2 into account in its revision, its structure fits well with what you have to demonstrate. It does not replace your own assessment, though. You decide whether the scope matches your use, whether the deviations are acceptable for you, and whether the customer controls are implemented on your side. How European supply chain security is developing is shown in the article on the Cybersecurity Act 2 and ICT supply chain security.

Another connection concerns switching providers. A C5 attestation says little about how easily you can leave the service again, and that is exactly what the EU Data Act regulates, with rules on switching and data access. Ask about both when buying: evidence of security and the ability to exit.

This is not legal advice. Clarify doubtful cases about your entity's obligations with your legal department or law firm.

Checklist: Reviewing a C5 attestation

This list is meant for procurement and security officers. Work through it before you approve or renew a cloud service.

Report and auditor

• The original report is in hand, not just a seal or a website claim
• Type (1 or 2) noted; for Type 1, a date for the Type 2 report is set
• Catalogue version clarified (C5:2020 or C5:2026) and gaps against the other version assessed
• Auditor and audit firm are named, qualification is plausible

Scope

• The service you ordered appears in the system description
• The locations and regions where your data is stored are covered
• Subservice providers are included or expressly carved out; in the second case replacement evidence is available
• Data categories (customer data, derived data, account data) are classified in the report

Period and currency

• For Type 2, the audit period is no older than your policy allows
• The next report is entered as a follow-up date in the service provider register
• For reports ending after February 28, 2027, the system description contains the transition information

Criteria and deviations

• Basic criteria fully audited, additional criteria included according to your requirements
• All deviations and exceptions read and assessed for your use
• For critical deviations, a statement and remediation schedule obtained from the provider
• Criteria marked not applicable are justified

Complementary user entity controls

• Each CUEC is recorded as its own measure with an owner
• Implementation status documented per CUEC (open, in progress, implemented)
• The CUECs are compared against each new report at least once a year

Contract and exit

• Security clauses in the contract refer to the attestation and the duty to deliver a current report
• Exit and switching arrangements clarified
• The assessment is documented and approved in the service provider register

Common mistakes when dealing with C5

Treating the attestation as a seal of quality. A C5 report is a document with qualifications, not a distinction. If you only file the cover page, you miss scope gaps and deviations. Read at least the system description, the deviations, and the CUECs.

Securing the wrong service. The attestation applies to the audited service, not to the provider. If you use another product from the same family, the report does not carry over. Compare at the very start.

Confusing Type 1 with Type 2. Type 1 says the controls fit on paper. Only Type 2 says they worked over months. For critical services this is a difference you should write into the contract.

Ignoring the customer controls. In cloud operations, configuration and permissions lie to a large extent with you and not with the provider. The CUECs name exactly these tasks. An attestation does not take this work off your hands.

Starting the switch too late as a provider. Type 2 periods cannot be moved retroactively. If you introduce the new controls shortly before the audit period, they will not have been in operation long enough to prove they are effective.

Conclusion: C5:2026 is an audit period you plan now

For providers, the switch starts not with the auditor but with the gap analysis and the decision about which additional criteria your customers expect. For customers, it starts with the question of which of your cloud services have an attestation, under which version, and with which scope. As a next step, take your five most important cloud providers and run them through the checklist.

ISMS Lite helps on the administrative side: you record service providers with criticality and contracts, keep the assessment and the evidence on the respective provider, and see in the deadline dashboard when the re-assessment is due.

Further reading

• Supplier Assessment with Security Questionnaires: Template and Approach
• Data Processing Agreements: How to Review DPAs and Assess Service Providers
• IT Security Clauses in Contracts: What You Should Demand from Service Providers
• CLOUD Act, Schrems II, and Your ISMS: What You Need to Know About US Government Data Access
• ISO 27001 Certification: Process, Costs, and Effort for SMEs