C5 - FAQ

Publisher

Bundesamt fuer Sicherheit in der Informationstechnik (BSI)

URL

https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5-FAQ/kriterienkatalog-c5-faq_node.html

Published

unknown

Updated

unknown

Accessed

2026-10-02

HTTP status

200

License

BSI website terms; no-redistribution; short excerpts and locators only

Source notes citing this source

• The C5:2026 criteria apply to engagements dated after 1 June 2027, with earlier adoption permitted. in context
• BSI C5 produces attestations, not certificates; the BSI currently operates no C5 certification programme. in context
• Only auditors may issue a C5 attestation, and the audit team's qualifications such as CISA, CISM, CCSK or ISO 27001 auditor must be listed in the attestation. in context
• The BSI does not supervise C5 audits or check C5 reports; it publishes the criteria but takes no part in testing or approving attestations. in context
• German federal agencies must request C5 evidence for external cloud services. in context
• A C5 attestation always refers to a completed past period, which under ISAE 3000 covers 3 to 12 months; it carries no forward validity date. in context
• Since 1 July 2024, section 393 of SGB V requires German healthcare cloud use to be backed by a C5 attestation or comparable certificate, and the Federal Ministry of Health, not the BSI, interprets that requirement. in context
• A SOC 2 Type 1 report examines whether controls are suitably designed, while a Type 2 report also tests the operating effectiveness of the controls during the reporting period. in context

Cite this source record

APA

WarmTransfer. (2026, October 2). C5 - FAQ. WarmTransfer. https://warmtransfer.net/knowledge/sources/bsi-bund-c5-faq

BibTeX

@misc{warmtransfer-bsi-bund-c5-faq,
  title  = {C5 - FAQ},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/sources/bsi-bund-c5-faq},
  note   = {Bundesamt fuer Sicherheit in der Informationstechnik (BSI), accessed 2026-10-02}
}