Germany C5

No changes recorded yet — we are watching, and nothing has been published.

1. 2027-06-01 in 204 days C5:2026 applies to type 1 reports dated, and type 2 periods beginning, on or after this date; earlier use is allowed (C5:2026 section 3.5)
2. 2026-08-11 C5:2026 version 1.1.0 published with corrections
3. 2026-04-07 C5:2026 version 1.0.0 first published
4. 2025-07-01 Cloud processing of health and social data in German statutory health insurance needs a current C5 type 2 attestation instead of type 1, except for systems in their first 18 months on the market (SGB V section 393(4))
5. 2021-02-15 BSI recommends C5:2020 for audit periods ending on or after this date

1. 2026-08-11
   C5:2026 version 1.1.0 ErrataCurrent text

   Corrections and editorial adjustments to C5:2026. source

2. 2026-04-07
   C5:2026 version 1.0.0 Major version

   A fundamental revision built on C5:2020 and on the EUCS Substantial requirements, with new criteria on topics such as container management, supply chains, post-quantum cryptography, confidential computing, tenant separation and sovereignty. source

   More

   • Criteria are split into distinct sub-criteria, and additional criteria are classed as either sharpening or complementing a basic criterion.
   • Published for the first time also in machine-readable form as YAML files, besides PDF and Excel.
   • Also takes into account the CSA Cloud Controls Matrix v4, ISO/IEC 27001:2022 and the NIS2 Directive.
3. 2020-01-19
   C5:2020 Major version

   Revised in dialogue with users, auditors, regulators and providers in 2019 and finalised in January 2020, adding product security and government investigation requests as new criteria areas. source

   More

   • Introduced the option of a direct audit, in which the auditor prepares the system description during the audit.
4. —
   C5:2016 Major version

   The first edition of the Cloud Computing Compliance Criteria Catalogue. source

C5 is aimed at professional cloud providers, their auditors and customers; SGB V makes an attestation a condition for cloud processing of German health and social data.

Audience

Minimum requirements for secure cloud computing aimed mainly at professional cloud providers, their auditors and customers. source

Health and social data

Healthcare providers, health and care insurance funds and their processors may process social and health data in the cloud only with a current C5 attestation on the C5 basic criteria, among other conditions (SGB V section 393(3)); an attestation or certificate to a standard of comparable or higher security level also qualifies (section 393(4)). source

Customers

Customers should request and evaluate the C5 report initially and then annually, and check whether their use case needs criteria beyond the minimum. source

Which edition

A type 2 engagement whose period starts before 1 June 2027 and ends after it should use only C5:2020; the two editions should not be combined in one engagement. source

An auditor engaged by the cloud provider issues a type 1 or type 2 attestation report under ISAE 3000 (Revised) or a national equivalent; customers should request it every year.

Attestation, not certificate

Auditors check whether the criteria are met and, depending on the report type, whether they were met throughout a period; the BSI does not select auditors, take part in audits or evaluate reports. source

Audit standard

Conformity assessments are performed in line with ISAE 3000 (Revised) or national equivalents such as German PS 860. source

Type 1 and type 2

A type 1 report covers design at a cut-off date and is limited to the first engagement; a type 2 report also covers operating effectiveness over a period of at least three and normally no more than twelve months. source

Annual report

Customers should request the C5 audit report initially and then regularly every year. source

The BSI takes no part in audits and does not evaluate reports; customers must analyse them, and SGB V section 393 makes an attestation a condition for processing.

BSI role

The BSI is not involved in selecting auditors or in the audit itself and does not evaluate the reports; customers must analyse them and bear remaining risks. source

Health sector

Processing of health and social data in the cloud is permitted only if the attestation exists and the customer criteria in its report are implemented (SGB V section 393(3)). source

1. Standard Kriterienkatalog Cloud Computing C5:2026, version 1.1.0 (PDF)
2. Guidance C5:2026 overview and downloads, including YAML and change history (BSI)
3. Standard C5:2020 and supporting documents (BSI)
4. Guidance Kriterienkatalog C5 - introduction (BSI)
5. Law text SGB V section 393 - cloud use in healthcare

1. BSI IT-Grundschutz

   BSI's general ISMS methodology for any institution, certified by the BSI, while C5 targets cloud services and is attested by independent auditors.

2. ISO 27017

   The international code of practice for cloud security controls, a guidance standard rather than an audit criteria catalogue.

3. SOC 2

   The US attestation report on service organisation controls, which also distinguishes type 1 and type 2 reports.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 18 September 2026. Subscribe to Germany C5 (RSS)