What Is BSI C5? Germany's Cloud Criteria Catalogue Explained

BSI C5 is the Cloud Computing Compliance Criteria Catalogue published by Germany's Federal Office for Information Security, known by its German initials BSI. It sets out security requirements that an independent auditor checks a cloud provider against, then reports on in a document structured much like a SOC 2 report. Procurement teams across the EU ask for it because German public sector buyers and many regulated industries treat it as baseline evidence for cloud risk assessments, not because it is a universal certification scheme. This explainer uses the BSI C5 framework page in the CertReports index to show what a genuine C5 report looks like, how it differs from a vendor simply stating that it follows C5 criteria, and where the catalogue sits next to France's SecNumCloud and the EU's NIS2 directive.

What BSI C5 actually is

BSI stands for Bundesamt für Sicherheit in der Informationstechnik, Germany's federal office for information security. It is the same body that runs the country's national cyber incident response and publishes guidance for critical infrastructure operators. It released the first Cloud Computing Compliance Criteria Catalogue in 2016 and updated it substantially in 2020 as C5:2020, the version still referenced by auditors and vendors today.

C5 is a catalogue of criteria, not a certificate. It groups controls into basic criteria, which every assessed provider is expected to meet, and additional criteria, which go further and are aimed at buyers with stricter requirements such as public bodies. The domains cover:

• Organisation of information security and security policy
• Personnel and asset management
• Physical security of data centres
• Operational security and vulnerability management
• Identity and access management
• Cryptography and key management
• Communications security
• Procurement, development and supplier management
• Incident handling and business continuity
• Compliance, including handling of customer data requests

An independent auditor assesses a cloud service against this catalogue under the ISAE 3000 assurance standard, the same family of standard used for SOC 2 reports. The output is an attestation report, signed by the audit firm, stating which criteria were tested and what the auditor found. That report, not a logo on a trust centre page, is what a buyer should actually ask to see.

What country BSI C5 certification is for

Phrases like "C5 certified" circulate in vendor marketing much the way "SOC 2 certified" does, and they are inaccurate for the same reason. C5 produces an auditor's attestation report, not a certificate issued by an accreditation body. There is no C5 certificate to frame on a wall.

BSI C5 is a German scheme. It was written for the German market, and German public sector procurement rules reference it directly when agencies buy cloud services. Its reach extends well past Germany, though. Multinational cloud providers selling into the EU often commission a single C5 report and then point every European public sector prospect at the same document, because German requirements tend to be stricter than most other member states' equivalents. Buyers in Austria, the Netherlands and the Nordic countries frequently accept a C5 report as supporting evidence even though their own regulators do not formally require it.

That is different from a scheme such as SecNumCloud, which France's cybersecurity agency ANSSI runs and which adds an ownership and legal immunity test that most US headquartered providers cannot pass. The What Is SecNumCloud, and Why US Clouds Don't Have It article covers that distinction in detail. C5 carries no equivalent sovereignty requirement. A US owned provider can hold a valid C5 report as long as the audited service meets the technical and organisational criteria, who owns the company sits outside the test.

2020

Current catalogue edition

C5:2020 replaced the original 2016 edition and is the version most current reports cite

6 to 12 months

Typical Type 2 audit period

Mirrors the period used for SOC 2 Type II engagements under the same ISAE 3000 family of standards

No

Central public registry

Unlike FedRAMP's Marketplace, there is no single public lookup for C5 reports

Mixed

Report or self attestation

Both appear under the BSI C5 label in the CertReports index on 2026-10-24

C5 Type 1 vs Type 2 reports, and what a self-attestation looks like

C5 reports come in two types, mirroring a structure buyers already know from SOC 2. A Type 1 report describes the design of controls at a single point in time. A Type 2 report covers a period, typically six to twelve months, and states whether the controls actually operated effectively throughout that window. A Type 2 report is the stronger evidence because it reflects sustained practice rather than a one day snapshot.

The harder problem for buyers is spotting the difference between either type of report and a self-attestation. Some vendor trust centres list BSI C5 as a badge or a line item with no attached document, no named auditor and no audit period. That is a vendor stating that it follows the C5 criteria internally, which is not the same as an independent third party checking the claim. The sensible approach is to record whether a published report exists, who issued it, and what period it covers, rather than taking the badge at face value. The same caution applies to every framework on a page, and the how to read a trust centre guide walks through the same check step by step.

How BSI C5 fits into NIS2 and wider EU vendor risk rules

The EU's NIS2 Directive requires essential and important entities to manage risk across their supply chain, including the cloud and managed service providers they rely on. NIS2 does not name BSI C5 as a mandatory control, but it does require organisations to assess supplier security practices and keep evidence of that assessment. A C5 report, particularly a Type 2 report with a recent period end date, is one of the more detailed pieces of evidence a buyer can point to when a regulator or internal auditor asks how a cloud supplier's security posture was reviewed. The What Is NIS2? Mapping Its Vendor Rules to Real Evidence article sets out the broader supplier management requirement.

C5 also sits alongside other national schemes that organisations check when NIS2 applies, including Spain's ENS and the EU's own cloud certification scheme, still being finalised by ENISA, which is expected to borrow heavily from C5's structure once it is adopted.

Where C5 evidence actually shows up

Unlike FedRAMP, which has a public Marketplace listing, BSI C5 has no central public registry that a buyer can search by vendor name. Evidence lives wherever a provider chooses to publish it: a trust centre page, a security whitepaper, or a document released only under NDA during procurement. That makes the claim easy to overstate. A provider can write "C5 aligned" on a marketing page without anyone checking what that means, which is why the report itself, with its named auditor, scope and period, is the only thing worth relying on.

Zoom's trust centre is a useful example of a vendor that lists BSI C5 next to several national and sovereign cloud frameworks from different countries. The card below renders what the index currently holds for Zoom across every framework it states. Look at whether the C5 line sits next to an attached report and a named auditor, or whether it reads as a stated claim with nothing to open.

Zoom · Trust report

Collaboration · Public evidence as of 26 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 18 vendor-stated.

• C5Vendor-statedTrust centre · 26 Oct 2026
• DPFVerifiedValid to 19 Dec 2026
• SOC 2Vendor-statedType II report
• FedRAMPVendor-statedTrust centre · 26 Oct 2026
• PCI DSSVendor-statedTrust centre · 26 Oct 2026
• ISO 27001Vendor-statedTrust centre · 26 Oct 2026
• CSA STARVendor-statedTrust centre · 26 Oct 2026
• Cyber EssentialsVendor-statedTrust centre · 26 Oct 2026
• ISO 27701Vendor-statedTrust centre · 26 Oct 2026

10 more frameworks on the evidence page

2Documents and agreements

Legal and review documents Zoom publishes or offers, as of 26 Oct 2026.

• Standard contractual clauses · On request
• AI and data use policy · On request

1Security practices

Public statements from Zoom, shown as statements, not attestations, as of 26 Oct 2026.

• Penetration testing · report available

How to check a vendor's BSI C5 claim

1. 1

   Find the actual document

   Open the vendor's trust centre or security page and look for a PDF or downloadable report named after C5, not just a badge or logo.

2. 2

   Check the report type

   Look for the word Type 1 or Type 2 on the cover page. A Type 2 report covers a defined audit period; a Type 1 report only covers a single date.

3. 3

   Confirm the auditor

   A genuine report names the audit firm that performed the assessment. If no firm is named anywhere on the page or in the document, treat the claim as a self-attestation.

4. 4

   Match the scope to the product you are buying

   C5 reports are scoped to specific services and data centre regions. Confirm the report actually covers the product and location your contract will use.

5. 5

   Check the period end date

   A C5 report with a period end date more than a year old, and no renewal notice, suggests the current audit has lapsed. Ask the vendor for the latest report before relying on it.

The Cloud Computing Compliance Criteria Catalogue, C5, defines requirements for the information security of cloud services that reflect the needs of cloud customers and are intended to be considered by cloud providers from the earliest stages of service design.