Attestation · Cloud security
Sightadel guides cloud providers through the C5:2026 criteria – with industry templates drawn from years of consulting and certification practice, AI that helps with the wording, and real consultants for the difficult parts. The attestation is issued by an independent auditor (certified public accountant).
What it is about
The C5 (Cloud Computing Compliance Criteria Catalogue) is the criteria catalogue of the German Federal Office for Information Security (BSI) for cloud services. It defines the minimum level of security a cloud provider should achieve and thus makes providers comparable. There is no BSI certificate for it: an independent auditor (certified public accountant) audits against the ISAE 3000 standard and issues an attestation.
In spring 2026, the BSI published the third generation. C5:2026 replaces C5:2020, contains considerably more basic criteria, breaks them down more finely into sub-criteria and addresses new topics such as container management, confidential computing and post-quantum cryptography. It is aligned with ISO 27001:2022, NIS2 and the European EUCS scheme.
The attestation comes in two forms. Type 1 confirms that the controls are suitably designed as at a reference date. Type 2 additionally confirms that they operated effectively throughout an audit period – and this is exactly where projects most often fail: evidence that is only gathered shortly before the audit does not cover the period.
For audit periods starting on or after 1 June 2027, only C5:2026 applies. Until then, audits against C5:2020 remain possible under transition rules, and existing attestations remain valid.
Under section 393 of the German Social Code, Book V (SGB V), healthcare providers may only have health and social data processed by cloud providers with a current C5 attestation. Without an attestation, you are excluded from consideration by these customers.
Public authorities and regulated clients ask for C5 as proof of cloud security. You need a system description, criteria coverage and robust evidence.
Moving to C5:2026 means delta work. If you map existing controls properly, you can see which criteria are new or stricter – instead of starting from scratch.
Requirements
Summarised in our own words. The original text in its current version is always authoritative.
A description of the cloud service, its boundaries, locations, subcontractors and the conditions to which the attestation relates.
In SightadelGuiding questions lead you to define the boundaries of the service. You maintain subcontractors in the Vendors module, and documents are versioned in the evidence archive.
Managed security with roles, responsibilities, risk management and approved policies.
In SightadelIndustry templates for policies, AI drafts for the wording. Roles, risk appetite and approvals remain your decision – Sightadel flags these points.
Screened and trained employees, well-defined operations with capacity, patch, logging and vulnerability management.
In SightadelTraining and reviews as recurring cycles. Every piece of evidence carries an expiry date, and Sightadel reminds you before the deadline.
Access based on the principle of least privilege, strong authentication, regular recertification and stricter requirements for privileged access.
In SightadelEvery criterion as a guided question with answer options. Access reviews run as a cycle, and the result of each run is filed as evidence.
State-of-the-art encryption and key management, reliable separation of customers and, new, preparation for post-quantum methods.
In SightadelTemplates for the cryptography concept and key management. You link technical evidence such as configurations or reports directly to the criterion.
Secure development and controlled changes, containers and images under control, requirements for service providers and the supply chain.
In SightadelThe Vendors module assesses service providers with questionnaires and risk. Deviations become action plans with owners and due dates.
Detecting, assessing, reporting and following up on incidents, as well as planned and tested recovery of the service.
In SightadelIncidents and exercises are traceable in the activity log. You schedule emergency tests as a recurring cycle with evidence.
Transparency towards customers about locations, subcontractors and changes, and a defined approach to investigation requests.
In SightadelThe Trust Center shows customers frameworks, documents, security posture and sub-processors – always up to date instead of a PDF in their inbox.
Optional additional criteria for higher protection requirements, as well as the controls the cloud customer must implement itself.
In SightadelFor each additional criterion, you decide whether it belongs in the audit scope. Justification and status remain traceable for the auditor.
Process
Four to eight months to audit readiness with an existing ISMS. Without groundwork, more like a year, and for Type 2 the audit period comes on top.
Which service, which locations, which subcontractors, Type 1 or Type 2. A clearly defined scope saves weeks later on.
Map existing controls and documents to the criteria. If you have ISO 27001 or C5:2020, you do not start from scratch here.
Go through all basic criteria step by step. Templates and AI provide drafts; you decide and link evidence.
The description of the service is the basis of the attestation. It must match what is actually operated.
A readiness check shows where evidence does not yet hold up. This is the cheapest point at which to close gaps.
Type 1 audits as at a reference date. Type 2 requires an audit period, often six to twelve months, during which the controls demonstrably operate.
Ready to start
Clarify these questions early and you save weeks later on. In Sightadel they are set up as your first tasks.
Division of work
If software filled everything in, the standard would not serve its purpose – and the auditor would notice. That is why it is clearly defined what stays with you.
From practice
From many years of consulting and certification practice: these are the points that cost the most time or lead to nonconformities in the audit.
An idealised description is spotted immediately in the audit. Have it reviewed by the teams that actually operate the service.
Too narrow is of little use to customers, too broad makes the audit more expensive. Align the scope with the services customers actually use.
For Type 2, every control must be documented across the entire period. File evidence continuously with a date.
Data centre, support or monitoring by third parties belong in the description. Record them with evidence and check their attestations.
Controls that customers must implement themselves belong in the description and customer information. Otherwise misunderstandings about responsibility arise.
Audit periods starting on or after this date run only under C5:2026. Plan the transition with your auditor in good time.
One piece of evidence, several frameworks
We deliberately do not give a percentage – it depends on your scope. Where requirements overlap, one piece of evidence is attached to all of them.
C5:2026 is aligned with ISO 27001:2022. An existing ISMS provides organisation, risk management and much technical evidence. Cloud-specific topics such as tenant separation are added.
NIS2Cloud providers often fall under NIS2 themselves. You prove risk management, supply chain and incident handling with the same evidence; registration and reporting channels are added.
DORAFinancial entities must monitor their ICT third-party service providers. A C5 attestation answers many of their questions but does not replace the contractual requirements under DORA.
GDPRTechnical and organisational measures under Art. 32 can be proven with the same evidence as encryption, access and logging in C5.
Audit and evidence
A C5 attestation is issued exclusively by an independent auditor (certified public accountant) under ISAE 3000. Sightadel does not issue attestations. You choose an audit firm from our independent partner network or one of your choice. No commission is paid for audits – neither to us nor to the partners.
The auditor receives their own access in Sightadel: they see criteria, answers, comments and linked evidence including history, add comments and – once you approve – create or edit entries. They can never delete anything. After the attestation, the Trust Center shows your customers the current status, documents and sub-processors – you continue to release the attestation itself in a controlled manner.
To the independent auditor networkA C5 attestation costs money in three places. The Sightadel licence for BSI C5 is charged per framework and edition, with a minimum term of one year. If your Sightadel licence includes ISO 27001 or ISO 9001, you receive a permanent discount on C5. You will find all prices and a calculator on our pricing page.
The second item is the audit by an independent auditor. They invoice independently. The effort depends on the scope of the cloud service, the number of locations and subcontractors, the additional criteria selected and, above all, the type of audit. A Type 2 attestation involves more work than Type 1, because the auditor takes samples across the entire audit period. Compare quotes by audit scope, audit period and experience with cloud services, not just by daily rate. Many providers combine the audit with a SOC 2 report to serve customers in Europe and North America.
The third and usually largest item is the internal effort: system description, policies, evidence from operations and development, supporting the auditor. Security officers, operations, development and purchasing are all involved. If you already run an ISMS based on ISO 27001, you start with a large part of the organisation and evidence in place. You can add consulting as a package in the Sightadel app.
In Germany, the C5 attestation is the most widely used proof of cloud service security for demanding customers. Public administration, hospitals, statutory health insurers and financial entities frequently ask for it. In healthcare, it is even required by law for certain cloud processing of health and social data, under section 393 of the German Social Code, Book V (SGB V). The obligation there lies with healthcare providers and payers, but they can only engage providers with an attestation.
An attestation replaces many individual security questionnaires. Instead of answering each request separately, you refer to an independent audit report that describes, criterion by criterion, what was audited. This shortens procurement processes and builds trust, because an independent auditor stands behind it.
Important: the attestation relates to a clearly defined service. Customers read the system description and audit scope closely. Define the scope so that it covers the services your customers actually use. In the Trust Center, you show customers your current status, documents and sub-processors. You continue to release the attestation itself in a controlled manner.
In spring 2026, the BSI published C5:2026. It is the third generation of the catalogue and replaces C5:2020. The basic idea remains: basic criteria as a minimum level, additional criteria for higher protection requirements, audit by an independent auditor.
What is new above all is the finer structure. Criteria are divided into sub-criteria, which makes audit and evidence management more precise but also more extensive. In terms of content, topics have been added that are now part of everyday cloud operations, such as container management, confidential computing and preparation for post-quantum cryptography. The catalogue is aligned with ISO 27001:2022, NIS2 and the European certification scheme EUCS.
The transition is important for planning. For audit periods starting on or after 1 June 2027, only C5:2026 applies. Switching earlier is permitted. If you are planning a Type 2 attestation today, you should check whether the audit period extends beyond this date and, if so, build directly on the new catalogue. Clarify the timetable early with your auditor.
The basis of every C5 audit is the system description. It describes the cloud service, its boundaries, locations, subcontractors used, how operations are organised and the general conditions. It must match actual operations, because that is exactly what the auditor compares.
In addition, there are policies and procedures for the topics in the catalogue: organisation of information security, personnel, asset management, physical security, operations, identity and access management, cryptography, communication security, portability, procurement and development, management of service providers, incident management, business continuity, compliance and handling of investigation requests. For each criterion, the auditor expects evidence: configurations, logs, tickets, audit reports, training records.
One point is often underestimated: the controls your customers must implement themselves so that the service is used securely. They belong in the description and should be known to customers. In Sightadel, all evidence is attached to the relevant criterion, with version and expiry date, and you maintain subcontractors in the Vendors module.
Many providers start with a Type 1 attestation. It confirms the suitable design of the controls as at a reference date and can be achieved faster. However, customers in regulated industries generally expect Type 2, i.e. additional proof of operating effectiveness across an audit period. You agree the period with the auditor, and subsequent audits usually follow on without a gap.
For Type 2: every control must have demonstrably worked throughout the entire period. The auditor takes samples, such as access reviews from different months, changes with approval, patches, emergency tests. If evidence from one month is missing, this can turn into an exception in the report. Evidence that is only gathered shortly before the audit does not cover the period.
A dry run a few months before the start of the audit period has proven its worth, internally or with a consultant. Gaps then become action plans with a deadline before the period begins. In Sightadel, recurring controls run as cycles, and each run is filed as dated evidence, so the auditor finds the samples directly in their own access.
A C5 attestation is a snapshot or a completed period. Customers therefore generally expect an up-to-date report every year. Plan the audit as a recurring cycle with a fixed audit period so that there is no gap between two reports.
C5 rarely stands alone. An ISMS based on ISO 27001 provides organisation, risk management and much technical evidence; cloud-specific criteria such as tenant separation, portability or transparency towards customers are added. Cloud providers often fall under NIS2 themselves and must register and set up reporting channels. Financial entities as customers will additionally assess you under DORA. And the technical and organisational measures under Art. 32 GDPR can be proven with the same evidence.
In Sightadel, you link a piece of evidence once to all matching criteria from C5, ISO 27001, NIS2 or SOC 2 and maintain it in one place. The auditor receives their own access without deletion rights, and the activity log shows who did what and when.
What it costs
You only pay for the frameworks you actually need. The editions differ in capacity and response time, not in subject-matter scope. If you run several frameworks, you save permanently. All prices, discounts and a calculator are on the pricing page.
The certification or audit body invoices its fees directly to you. If needed, you can add consulting as a package in the app.
Working materials
Checklists and templates for other frameworks are available under Resources.
Practical aids, not legal advice.
Terms
No. C5 is a criteria catalogue published by the BSI. Whether a cloud service meets it is audited by an independent auditor under ISAE 3000. The result is an attestation in the form of an audit report, not a BSI certificate.
Type 1 confirms the suitable design of the controls as at a reference date. Type 2 additionally confirms their operating effectiveness across an audit period. Customers in healthcare and regulated industries generally expect Type 2.
If you offer cloud services and want to win customers in healthcare, the public sector or regulated industries, very probably. The legal obligation usually lies with your customers, not with you. If nobody asks for it, you do not need it.
C5:2026 has been published since spring 2026. For audit periods starting on or after 1 June 2027, only C5:2026 applies. Until then, audits against C5:2020 are possible under transition rules, and existing attestations remain valid.
Yes, considerably. C5:2026 is aligned with ISO 27001:2022. In Sightadel, you link existing evidence once and use it for both frameworks. You still need to provide separate evidence for cloud-specific criteria.
Two items: the Sightadel licence for BSI C5:2026 (prices on our pricing page) and the independent auditor, who invoices independently. Their effort depends on the scope of the service and the type of audit. Internal time comes on top.
No, deliberately so. The AI provides drafts from industry templates and helps with the wording. You describe yourself how your service is actually operated – the auditor checks precisely this consistency.
Sightadel contains structure, controls, guiding questions, templates and its own explanations. The BSI publishes the catalogue itself free of charge. The original text is always authoritative for the audit.
It often takes four to eight months to reach audit readiness, less with an existing ISMS. For Type 1, the audit as at the reference date then follows. For Type 2, there is also the audit period, which you agree with the auditor, followed by preparation of the report. For your first Type 2 attestation, expect a year in total rather than a quarter.
Both are an independent auditor's reports on a service provider's controls, and both come as Type 1 and Type 2. C5 comes from the BSI and is geared towards cloud services and the German market; SOC 2 comes from the US and is the usual proof there. Many providers have both prepared in a joint audit and use the same evidence.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
