C5 was first published in 2016 and updated in 2020 to align with international cloud-assurance schemes, including the Cloud Security Alliance STAR, AICPA SOC 2, and BSI's own Grundschutz. The catalogue covers the full lifecycle of a cloud service — from the physical security of the data centre through organisational and personnel controls, to the technical security of the platform, secure development, and the management of incidents, changes, and sub-processors. It is deliberately comprehensive, which is also what makes it a meaningful attestation rather than a checkbox exercise.
What makes C5 specifically German, and specifically important, is its relationship to public-sector procurement. A cloud provider that wants to sell to German federal, state, or municipal government — or to the many regulated industries that follow public-sector standards — is effectively required to hold a C5 attestation. The same is increasingly true for the German Mittelstand and for any organisation that needs to demonstrate supply-chain due diligence under NIS2.
The audit process is a Type II attestation: it tests not just whether the right controls exist on paper, but whether they operated effectively across a defined review period, typically six to twelve months. The auditor issues a report the cloud provider can share with customers under NDA, so customers can rely on one rigorous assessment rather than each conducting their own. This is the same model SOC 2 uses, and C5 is recognised as broadly equivalent for European buyers.
For a cloud provider, achieving C5 is a multi-month effort. The work is not just technical — hardening the platform, tightening access controls, improving logging — but also documentary: every control needs evidence, every process needs to be written down and proven to operate, and the provider's sub-processors must be brought into scope. Passeca has guided cloud providers through this from scoping and gap analysis through implementation, internal audit, and the certification audit itself.
C5 sits alongside ISO 27001 and SOC 2 in the European cloud-assurance landscape, and a provider serious about the German market will often hold two or three of them. ISO 27001 proves an information security management system exists; C5 proves the cloud-specific controls operate effectively; SOC 2 bridges to US-headquartered customers. Passeca helps providers choose the right combination and run a single evidence programme that serves all of them.