At the beginning of April 2026, the German Federal Office for Information Security (BSI) published the third generation of its criteria catalogue for cloud services. C5:2026 replaces C5:2020, which was the reference for cloud security in Germany for six years. If you offer cloud services and hold or are planning a C5 attestation, now is the time to look at the timetable. The cut-off date for the transition is closer than it seems at first glance.
What C5 is about
The Cloud Computing Compliance Criteria Catalogue describes the minimum security requirements a cloud service should meet. It is aimed at providers of infrastructure, platforms and software as a service. There is no certificate in the strict sense. Instead, an independent auditor examines against the ISAE 3000 assurance standard and issues an attestation. Type 1 examines the suitability of the controls at a point in time; Type 2 additionally examines their operating effectiveness over a period, usually six to twelve months.
For most providers, C5 is not a legal requirement. In practice, however, public-sector clients, the healthcare sector and many companies ask for it when selecting cloud services. For providers in the German market, it is therefore often the ticket to entry.
What is new
The basic idea remains the same: basic criteria as the minimum level, additional criteria for higher protection requirements, examination by an independent auditor. The catalogue is still divided into 17 domains. What has changed above all is the depth. Many requirements are split into finer individual criteria and worded more precisely. In terms of content, several topics have been added or significantly expanded:
- Containers and orchestration. The operation of containerised environments is described in much more concrete terms than before.
- Supply chain. Transparency about the software and suppliers used carries more weight, including software bills of materials (SBOM).
- Cryptography and post-quantum methods. The section on encryption is more detailed and covers the transition to methods intended to withstand future quantum computers, for example through hybrid approaches.
- Confidential computing. The protection of data during processing is addressed specifically for the first time.
- Tenant separation. The separation of different customers’ data is defined more precisely.
The catalogue is also aligned with ISO/IEC 27001:2022 and takes up the European cybersecurity certification scheme for cloud services (EUCS). The BSI also uses C5:2026 as the basis for its separately published criteria on the sovereignty of cloud services.
When the new catalogue applies
The key date is 1 June 2027. For audits whose audit period begins on or after this date, only C5:2026 is permitted. Until then, audits can still be carried out against C5:2020. Transitioning earlier is expressly possible. Existing C5:2020 attestations remain valid. The BSI provides special transition rules for audits that end shortly before the cut-off date. Agree the details with your auditor.
A simple calculation shows what this means in practice. A Type 2 attestation requires the controls to have been effective throughout the entire audit period. If your next audit period starts in summer 2027, you must already meet the new criteria at the start of that period. The preparation – gap analysis, adapting processes and technology, documentation – therefore falls within the coming six months.
How to approach the transition
- Clarify the timetable. Check with your auditor when your next audit period begins and whether it is affected by the cut-off date.
- Gap analysis. Map your existing controls to the new criteria. This shows you what still applies unchanged, what has been tightened and what is new.
- Prioritise the new topics. Container operations, software bills of materials and cryptography planning often need lead time in engineering and procurement. Start there.
- Keep evidence over time. For Type 2, what counts is not the state on the reference date but effectiveness over the period. Decide who produces which evidence and when.
- Use synergies. If you run an ISMS under ISO 27001 or fall under NIS2, you already have many of the foundations. Cloud-specific criteria are added nonetheless.
What this means for you
If you hold a valid C5:2020 attestation, there is no immediate pressure regarding the attestation itself. There is, however, for preparing the next audit period. Plan the gap analysis now so that the new criteria are effective in time. If you are new to C5, build directly on C5:2026.
In Sightadel, you work through the C5:2026 criteria step by step and attach evidence once, even if it also counts for ISO 27001 or NIS2. The attestation is issued by an independent auditor. More on the BSI C5 page. Try it yourself: Try free for 14 days.
As of: 2 October 2026 · Not legal advice. The standard or law in its current version is authoritative.
