BSI C5:2020Supported in OneClickComply

Prepare for your BSI C5 attestation with less manual effort

C5 (Cloud Computing Compliance Criteria Catalogue) is the German Federal Office for Information Security's catalogue of minimum security criteria for cloud services. C5:2020 contains 121 basic criteria in 17 areas, plus additional criteria and information on the cloud service's general conditions. Cloud providers show they meet it through an independent audit that results in a C5 attestation report for customers.

See the C5 requirements

C5 Aligned

Automated Evidence

OneClickFix Enabled

Continuous Monitoring

In-House Audit Team

Who needs C5

Is C5 right for your organisation?

Cloud service providers need C5 when German public sector bodies, healthcare organisations, banks, insurers or other regulated customers ask for proof of cloud security. In German healthcare, statutory rules on cloud use make a C5 attestation a practical requirement for providers processing health and social data. Many international providers also hold C5 reports to win and keep German enterprise customers.

It is usually required by customers, partners or schemes rather than by law.

Issued by: Federal Office for Information Security (BSI), Germany
Published: 21 January 2020 (C5:2020)
Structure: 121 basic criteria in 17 areas, plus additional criteria
Assessment route: Independent audit under ISAE 3000 (Revised), Type 1 or Type 2 attestation report
Applies to: Cloud service providers
Successor: C5:2026, recommended by BSI for audit periods ending on or after 1 June 2027
Type: Standard (contractual)
Region: Germany, EU
In OneClickComply: Supported today

How we help

OneClickComply makes it simple

BSI C5:2020 is mapped in OneClickComply's control library and is available on request. We map the C5 criteria to the controls you already run for ISO 27001 and other frameworks, collect evidence automatically from your cloud, identity and device tools, and generate the policies the catalogue expects. Our in-house audit team can review your readiness before your auditor's C5 engagement.

Requirements covered

121 basic criteria across 17 areas, from Organisation of Information Security (OIS) to Product Safety and Security (PSS), with additional criteria and six criteria on the cloud service's general conditions (BC-01 to BC-06).

Already working towards another framework?

ISO 2700117% of C5 overlaps
SOC 288% of C5 overlaps
NIST CSF74% of C5 overlaps
GDPR16% of C5 overlaps

Evidence you collect once counts towards every framework it applies to.

Manual C5 vs. OneClickComply

Manual C5

Reading 121 criteria and working out which controls and evidence each one needs
Gathering screenshots and exports from every cloud console for a Type 2 audit period
Writing and maintaining the many policies and instructions the catalogue expects
Duplicating effort because C5, ISO 27001 and SOC 2 evidence is kept in separate spreadsheets
Finding control failures only when the auditor tests them at the end of the period

With OneClickComply

Each C5 criterion is mapped to concrete controls, owners and evidence requirements
Evidence is collected automatically from connected tools throughout the audit period
Policies are generated from your real environment and kept ready for review
Evidence collected once counts towards C5, ISO 27001, SOC 2 and other mapped frameworks
Continuous monitoring flags control drift early so you can fix it before testing

Capabilities

Everything you need for C5

C5:2020 criteria mapped to the controls you already run for ISO 27001

Automated evidence collection for identity, logging, encryption and backup criteria

AutoComplete policies for ISMS, access, cryptography, incident and supplier criteria

Continuous monitoring with alerts when cloud controls drift between audit periods

OneClickFix for supported misconfigurations, with each change logged as evidence

Vendor risk management and supplier register for the SSO criteria

How it works

Three steps to C5 compliance

Connect & scan

Connect your cloud, identity and SaaS tools. OneClickComply checks them against C5 and shows you exactly where you stand.

Fix & generate

OneClickFix remediates technical gaps in one click, and AutoComplete generates C5-aligned policies from your real environment.

Monitor & evidence

Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.

Requirements

BSI C5:2020 requirements

All 121 C5:2020 basic criteria across the 17 areas; additional criteria and the BC-01 to BC-06 general condition criteria are not listed.

Reference	Requirement
OIS-01	Information Security Management System (ISMS)
OIS-02	Information Security Policy
OIS-03	Interfaces and Dependencies
OIS-04	Segregation of Duties
OIS-05	Contact with Relevant Government Agencies and Interest Groups
OIS-06	Risk Management Policy
OIS-07	Application of the Risk Management Policy
SP-01	Documentation, Communication and Provision of Policies and Instructions
SP-02	Review and Approval of Policies and Instructions
SP-03	Exceptions from Existing Policies and Instructions
HR-01	Verification of Qualification and Trustworthiness
HR-02	Employment Terms and Conditions
HR-03	Security Training and Awareness Programme
HR-04	Disciplinary Measures
HR-05	Responsibilities in the Event of Termination or Change of Employment
HR-06	Confidentiality Agreements
AM-01	Asset Inventory
AM-02	Acceptable Use and Safe Handling of Assets Policy
AM-03	Commissioning of Hardware
AM-04	Decommissioning of Hardware
AM-05	Commitment to Permissible Use, Safe Handling and Return of Assets
AM-06	Asset Classification and Labelling
PS-01	Physical Security and Environmental Control Requirements
PS-02	Redundancy Model
PS-03	Perimeter Protection
PS-04	Physical Site Access Control
PS-05	Protection from Fire and Smoke
PS-06	Protection Against Interruptions Caused by Power Failures and Other Such Risks
PS-07	Surveillance of Operational and Environmental Parameters
OPS-01	Capacity Management: Planning
OPS-02	Capacity Management: Monitoring
OPS-03	Capacity Management: Controlling of Resources
OPS-04	Protection Against Malware: Concept
OPS-05	Protection Against Malware: Implementation
OPS-06	Data Backup and Recovery: Concept
OPS-07	Data Backup and Recovery: Monitoring
OPS-08	Data Backup and Recovery: Regular Testing
OPS-09	Data Backup and Recovery: Storage
OPS-10	Logging and Monitoring: Concept
OPS-11	Logging and Monitoring: Metadata Management Concept
OPS-12	Logging and Monitoring: Access, Storage and Deletion
OPS-13	Logging and Monitoring: Identification of Events
OPS-14	Logging and Monitoring: Storage of the Logging Data
OPS-15	Logging and Monitoring: Accountability
OPS-16	Logging and Monitoring: Configuration
OPS-17	Logging and Monitoring: Availability of the Monitoring Software
OPS-18	Managing Vulnerabilities, Malfunctions and Errors: Concept
OPS-19	Managing Vulnerabilities, Malfunctions and Errors: Penetration Tests
OPS-20	Managing Vulnerabilities, Malfunctions and Errors: Measurements, Analyses and Assessments of Procedures
OPS-21	Involvement of Cloud Customers in the Event of Incidents
OPS-22	Testing and Documentation of Known Vulnerabilities
OPS-23	Managing Vulnerabilities, Malfunctions and Errors: System Hardening
OPS-24	Separation of Datasets in the Cloud Infrastructure
IDM-01	Policy for User Accounts and Access Rights
IDM-02	Granting and Change of User Accounts and Access Rights
IDM-03	Locking and Withdrawal of User Accounts in the Event of Inactivity or Multiple Failed Logins
IDM-04	Withdraw or Adjust Access Rights as the Task Area Changes
IDM-05	Regular Review of Access Rights
IDM-06	Privileged Access Rights
IDM-07	Access to Cloud Customer Data
IDM-08	Confidentiality of Authentication Information
IDM-09	Authentication Mechanisms
CRY-01	Policy for the Use of Encryption Procedures and Key Management
CRY-02	Encryption of Data for Transmission (Transport Encryption)
CRY-03	Encryption of Sensitive Data for Storage
CRY-04	Secure Key Management
COS-01	Technical Safeguards
COS-02	Security Requirements for Connections in the Cloud Service Provider's Network
COS-03	Monitoring of Connections in the Cloud Service Provider's Network
COS-04	Cross-Network Access
COS-05	Networks for Administration
COS-06	Segregation of Data Traffic in Jointly Used Network Environments
COS-07	Documentation of the Network Topology
COS-08	Policies for Data Transmission
PI-01	Documentation and Safety of Input and Output Interfaces
PI-02	Contractual Agreements for the Provision of Data
PI-03	Secure Deletion of Data
DEV-01	Policies for the Development/Procurement of Information Systems
DEV-02	Outsourcing of the Development
DEV-03	Policies for Changes to Information Systems
DEV-04	Safety Training and Awareness Programme Regarding Continuous Software Delivery
DEV-05	Risk Assessment, Categorisation and Prioritisation of Changes
DEV-06	Testing Changes
DEV-07	Logging of Changes
DEV-08	Version Control
DEV-09	Approvals for Provision in the Production Environment
DEV-10	Separation of Environments
SSO-01	Policies and Instructions for Controlling and Monitoring Third Parties
SSO-02	Risk Assessment of Service Providers and Suppliers
SSO-03	Directory of Service Providers and Suppliers
SSO-04	Monitoring of Compliance with Requirements
SSO-05	Exit Strategy for the Receipt of Benefits
SIM-01	Policy for Security Incident Management
SIM-02	Processing of Security Incidents
SIM-03	Documentation and Reporting of Security Incidents
SIM-04	Duty of the Users to Report Security Incidents to a Central Body
SIM-05	Evaluation and Learning Process
BCM-01	Top Management Responsibility
BCM-02	Business Impact Analysis Policies and Instructions
BCM-03	Planning Business Continuity
BCM-04	Verification, Updating and Testing of the Business Continuity
COM-01	Identification of Applicable Legal, Regulatory, Self-Imposed or Contractual Requirements
COM-02	Policy for Planning and Conducting Audits
COM-03	Internal Audits of the Information Security Management System
COM-04	Information on Information Security Performance and Management Assessment of the ISMS
INQ-01	Legal Assessment of Investigative Inquiries
INQ-02	Informing Cloud Customers about Investigation Requests
INQ-03	Conditions for Access to or Disclosure of Data in Investigation Requests
INQ-04	Limiting Access to or Disclosure of Data in Investigation Requests
PSS-01	Guidelines and Recommendations for Cloud Customers
PSS-02	Identification of Vulnerabilities of the Cloud Service
PSS-03	Online Register of Known Vulnerabilities
PSS-04	Error Handling and Logging Mechanisms
PSS-05	Authentication Mechanisms of the Cloud Service
PSS-06	Session Management
PSS-07	Confidentiality of Authentication Information in the Cloud Service
PSS-08	Roles and Rights Concept
PSS-09	Authorisation Mechanisms
PSS-10	Software Defined Networking
PSS-11	Images for Virtual Machines and Containers
PSS-12	Locations of Data Processing and Storage

Always check the official C5 text for the exact wording.

C5 FAQs

What is BSI C5?

BSI C5 is the Cloud Computing Compliance Criteria Catalogue published by Germany's Federal Office for Information Security (BSI). It defines minimum security criteria for cloud services and how providers should demonstrate them through an independent audit. C5:2020 contains 121 basic criteria across 17 areas, including identity and access management, cryptography, operations, incident management and handling of government investigation requests.

Who needs a C5 attestation?

Cloud service providers need a C5 attestation when their customers require one. This is common for German federal and public sector bodies, healthcare organisations, banks and insurers. In German healthcare, statutory rules on the use of cloud services for health and social data make C5 a practical requirement. Many global cloud providers hold C5 reports to support German and wider European customers.

Is BSI C5 a certification?

No, C5 is not a certificate issued by the BSI. The BSI does not carry out C5 audits. Instead, an independent auditor performs an assurance engagement, usually based on ISAE 3000 (Revised), and issues an attestation report. A Type 1 report covers the design of controls at a point in time, while a Type 2 report also tests operating effectiveness over a period.

What is the difference between C5:2020 and C5:2026?

C5:2026 is the successor to C5:2020, published by the BSI in 2026. It builds on C5:2020, aligns with the EU cloud certification scheme work (EUCS) and adds criteria on topics such as container management, supply chain and post-quantum cryptography. The BSI recommends applying C5:2026 for audit periods ending on or after 1 June 2027, so C5:2020 remains in use until then.

How does C5 relate to ISO 27001?

C5 builds on ISO 27001 and other established standards, and the BSI publishes a cross-reference table between them. An ISO 27001 certified ISMS covers much of the governance groundwork, but C5 adds cloud-specific criteria such as transparency about data locations, handling of government investigation requests, product security and customer-facing guidance. Controls and evidence can usually be shared between both.

How does C5 relate to SOC 2?

C5 and SOC 2 are both auditor-issued attestation reports with Type 1 and Type 2 options, and many controls overlap, such as access management, change management, logging and incident response. C5 is more prescriptive for cloud services and includes German and European specific requirements. Auditors can often combine C5 testing with an existing SOC 2 or ISAE 3402 engagement.

How long does it take to get a C5 attestation?

The timeline depends on your existing controls and the report type. A provider with a mature ISO 27001 or SOC 2 programme will mainly need to close C5-specific gaps before a Type 1 audit. A Type 2 report additionally needs controls to operate over an observation period chosen with the auditor. Automating evidence collection shortens preparation and reduces audit effort.

Does OneClickComply support BSI C5?

Yes, on request. BSI C5:2020 is mapped in OneClickComply's control library and available on request, rather than live as a standard framework today. Once enabled, it uses the same controls, automated evidence and policies as your other frameworks, so work done for ISO 27001 or SOC 2 counts towards C5. OneClickComply does not issue C5 attestations; an independent auditor does.

Related standards

All standards

Get C5 ready, not stressed

Automate controls, gather evidence continuously and stay audit-ready, all on one platform.