BSI C5 Compliance
For cloud service providers targeting German public-sector and regulated buyers — the BSI Cloud Computing Compliance Controls Catalogue.
BSI C5 is the German Federal Office for Information Security's control catalogue for cloud providers, attested by a qualified, independent auditor. Passeca scopes your service against the catalogue, closes the basic and extended requirements, and accompanies you through the audit — building evidence in Hyperproof that also serves ISO 27001 and SOC 2.
What is BSI C5?
BSI C5 (the Cloud Computing Compliance Controls Catalogue) is a catalogue of minimum technical and organisational security controls for cloud service providers. It is published and maintained by the Bundesamt für Sicherheit in der Informationstechnik (BSI), the German Federal Office for Information Security.
C5 exists to give cloud customers — especially German public-sector bodies and regulated industries — a reliable, independent attestation that a cloud service meets a defined baseline of security. A qualified, independent auditor assesses the provider against the catalogue and issues an attestation report. The catalogue contains basic security requirements applicable to all services and a set of extended requirements for services handling higher protection needs.
Who needs BSI C5?
- You sell cloud services to German public sector. Federal, state and municipal authorities in Germany expect C5 as the baseline assurance.
- You serve German regulated industries. BaFin-supervised banks and insurers reference C5 in their cloud guidance.
- You are an IaaS, PaaS or SaaS provider. C5 applies across the cloud service models.
- A procurement questionnaire asked for it. C5 is frequently a hard requirement in German enterprise and public-sector tenders.
What does BSI C5 actually require?
The C5 catalogue is organised into control themes that span the full lifecycle of a cloud service — from the provider's organisation through to the technical operation of the platform. Every theme contains basic requirements; the extended requirements add stricter controls for higher protection needs.
- Organisation of the cloud service provider — governance, policies, roles, and security management.
- Personnel — background checks, confidentiality, onboarding/offboarding and awareness.
- Asset, identity and access management — least privilege, MFA, privileged-access control and segregation of duties.
- Cryptography and key management — encryption in transit and at rest, and secure key lifecycle.
- Operations and change management — patching, change control, secure development and vulnerability management.
- Tenant separation and virtualisation security — isolation between customers, hypervisor hardening.
- Logging, monitoring and incident management — audit trails, detection and response.
- Business continuity and resilience — backup, DR and contingency planning.
- Data residency and portability — location guarantees and exit support.
The extended requirements layer additional controls on top of these themes, for example stronger cryptography thresholds, more granular logging, and heightened resilience obligations for services handling sensitive or high-protection-need data.
How Passeca gets you C5 attested
- 01
Scope & applicability check
We confirm that C5 is the right attestation for your buyers (German public sector and regulated industries), determine whether the C5 core or extended requirements apply, and define the audit scope with you.
- 02
Gap analysis against the C5 catalogue
We assess your cloud service against the BSI C5 control catalogue, identifying gaps against both the basic security requirements and, where applicable, the extended requirements for higher protection needs.
- 03
Remediation roadmap
We prioritise the gaps — those addressing German public-sector requirements and data residency come first — and build a sequenced, costed plan with owners and dates.
- 04
Implementation & evidence
We implement the missing controls and capture evidence in Hyperproof, mapped to the C5 catalogue so it also serves ISO 27001 and SOC 2 — the three share a large control overlap.
- 05
Audit by a qualified auditor
We introduce you to a qualified, independent auditor, support the audit fieldwork, and manage the response to any findings until the C5 attestation report is issued.
What you get from the engagement
How long does a BSI C5 attestation take?
| Requirement tier | Typical duration | Auditor fieldwork |
|---|---|---|
| Core requirements (ISO 27001 baseline) | 5–7 months | 4–6 weeks |
| Core requirements (no baseline) | 7–10 months | 4–6 weeks |
| Extended requirements | 8–12 months | 6–8 weeks |
The extended requirements add material effort on top of the core catalogue, particularly around cryptography and logging. Starting from an existing ISO 27001 ISMS is the single biggest accelerator.
How much does BSI C5 attestation cost?
Two fees apply: Passeca's consulting fee and the qualified auditor's audit fee, which must be independent. Extended requirements cost more than core. German data-residency requirements may also drive technology cost.
| Tier | Consulting (Passeca) | Qualified-auditor fee |
|---|---|---|
| Core requirements | Price on request | Quoted separately by the independent auditor |
| Extended requirements | Price on request | Quoted separately by the independent auditor |
Doing more than one framework?
| BSI C5 | ISO 27001 | SOC 2 | |
|---|---|---|---|
| Governance & policy | |||
| Access control | |||
| Cryptography & key mgmt | |||
| Tenant separation | Cloud-specific | Generic | Generic |
| Logging & monitoring | |||
| Data residency | Explicit | Implicit | Implicit |
| Audience | DE public sector | Global | US / global |
C5, ISO 27001 and SOC 2 share a large control core. The cloud-specific and German-specific elements — tenant separation and data residency — are what Passeca layers on top of an ISO 27001 or SOC 2 baseline, so you can serve German public-sector and global enterprise buyers with one body of work in Hyperproof.
BSI C5 compliance, answered
The questions cloud providers ask about meeting C5.
What is BSI C5?
Who needs BSI C5?
What is the difference between C5 core and C5 extended requirements?
How long does a BSI C5 attestation take?
Does ISO 27001 help with BSI C5?
How is BSI C5 different from SOC 2?
How much does a BSI C5 attestation cost?
How long is a BSI C5 attestation valid?
Selling cloud to German public sector?
Book a free compliance consultation. We will tell you whether you need core or extended requirements and give you a timeline and cost band.
Related