Since 2016, the BSI has been using the „Cloud Computing Compliance ”Criteria Catalogue" (C5), the German standard for secure Cloud-Services. C5:2026 marks the second major revision. The catalog now includes expanded requirements in 17 areas, new technical criteria, and a stronger focus on European regulations.
What is BSI C5:2026?
The C5 is a test catalog published by the Federal Office for Information Security (BSI) that specifies the minimum information security requirements for Cloud-Services. Cloud-With this catalog, suppliers can demonstrate their compliance through an independent Audit by a qualified third party. The result is a publicly available audit report that provides companies and government agencies with a reliable and comparable basis for their decisions regarding the Cloud provides.
Since its introduction, the C5 has become an internationally recognized reference standard. C5:2026 builds on the proven foundation of C5:2020 and supplements it with extensive new requirements. This is a response to changing technical conditions, new threat scenarios, and increasing regulatory pressure in Europe.
The C5:2020 served as the basis for the safety requirements of the proposed European Cloud-EUCS Certification Schemes (EU Cybersecurity Certification Scheme for Cloud Services) at the substantial level. The requirements developed by ENISA and CEN/CENELEC in this process, in turn, form the technical basis for C5:2026, which additionally includes the CSA Cloud Controls Matrix v4, ISO/IEC 27001:2022, and the NIS2 Directive have been incorporated.
The C5:2026 is therefore not only a national standard, but also forms the foundation of the European Cloud-regulation.
The Key Changes in C5:2026
In C5:2026, the BSI identifies five key areas of revision compared to C5:2020:
- New Technical Criteria
Container management, supply chain management, post-quantum cryptography, and confidential computing are being explicitly regulated for the first time.
- Digital Sovereignty
Multi-tenancy and the technical implementation of sovereignty are examined in greater detail—so that customers can make informed, independent decisions about the Cloud-use.
- More Advanced Data Applications
C5:2026 specifies more precisely which categories of data are subject to individual criteria (customer data, Cloud Service Derived Data, Account Data). This clarification was made based on frequent feedback received regarding C5:2020.
- New Criteria Structure
Criteria now consist of clearly defined subcriteria—to enable more precise mapping to internal control systems and provide greater clarity during audits. The structure is based on the EUCS.
- Explicit Classification of the Additional Criteria
Additional criteria are now explicitly distinguished based on whether they tighten existing basic criteria (sharpening) or supplement them with new requirements (complementing).
The 17 security zones of the C5:2026
The C5:2026 divides its requirements into 17 areas, supplemented by so-called „General Conditions”—mandatory transparency disclosures regarding the framework conditions of the Cloud-Service.
Basic Criteria and Additional Criteria: What Applies to Whom?
The catalog systematically distinguishes between two levels of criteria. The basic criteria define the minimum level of protection for Cloud-Services that process information with standard security requirements. These constitute the mandatory minimum scope of every C5 audit.
For companies with increased security needs—such as those handling sensitive business data, personal data, or critical infrastructure—the additional criteria come into play. These are divided into “sharpening” criteria, which replace existing basic requirements with stricter standards, and “complementing” criteria, which introduce new requirements that go beyond the existing ones.
The BSI explains: „In the BSI’s view, the basic criteria reflect the minimum level of information security that a Cloud-must provide the service if Cloud-Customers use it to Processing ”to use information with standard security requirements."
The General Conditions: Transparency as an Obligation
In addition to the safety criteria, C5:2026 stipulates so-called „General Conditions”: standardized information that Cloud-that providers must disclose to their customers. These include, among other things:
- Information on applicable law,
- Jurisdiction and Business Locations (GC-01),
- Information on Availability and Incident Handling (GC-02),
- Recovery parameters for emergency operation (GC-03),
- Regulations on Data Deletion Upon Contract Termination (GC-04),
- Policies for Handling Inquiries from Government Authorities (GC-05) and
- Existing certifications and attestations (GC-06).
These transparency requirements are not only intended to inform customers. They also provide a uniform basis for comparison among different C5-certified providers, thereby facilitating well-informed procurement decisions.
Important for Customers: New Technical Focus Areas
Post-Quantum Cryptography (CRY): For the first time, C5:2026 explicitly sets forth the requirements for cryptographic methods that are also resistant to future attacks by quantum computers. Cloud-Providers must be able to demonstrate a migration plan for the transition to quantum-secure algorithms.
Confidential Computing (OPS-32/33): C5:2026 introduces new criteria for procedures in which data is also processed during the Processing remain encrypted. This includes requirements for remote attestation—the technically verifiable trustworthiness of an execution environment.
Container Management (OPS-34/35): Given the widespread use of containerized workloads, C5:2026 defines specific requirements for security policies, container image management, and runtime monitoring throughout the entire container lifecycle.
Type 1 and Type 2 Audit Reports
C5 compliance is determined by independent third-party auditors in accordance with ISAE 3000 or its German counterpart, IDW PS 860. There are two types of reports:
- A Type 1 report evaluates the adequacy of controls as of a specific date and is permitted only for initial audits.
- A Type 2 report also evaluates the actual effectiveness of the controls over a defined period of at least three and at most twelve months. For recurring audits, only the Type 2 report is required.
As a rule, the examiner is appointed by the Cloud-provider and not commissioned by the customer. The BSI is on Audit is not involved itself. To help customers conduct a structured analysis of C5 reports, the BSI provides an Excel-based analysis tool. In addition, the BSI publishes on its website bsi.bund.de/C5 a cross-reference table that maps the C5 criteria to other frameworks such as SOC 2, ISO/IEC 27001, or the CSA Cloud Controls Matrix. This table is a useful tool for companies that apply multiple standards simultaneously.
C5:2026, effective June 2027
C5:2026 must be applied starting June 1, 2027. As of that date, Type 1 reports must be based on the new standard, and Type 2 reports must cover audit periods beginning on or after that date. Earlier implementation is expressly permitted. Providers who were previously certified under C5:2020 must adapt their internal control systems accordingly.
Reading tip: KRITIS Framework Act – New Requirements for Operators of Critical Infrastructure
Evaluate the C5 criteria for your specific use case
The C5:2026 provides companies that Cloud-Use or evaluate services, providing a reliable basis for assessing providers. A C5 certificate confirms that a provider meets the minimum requirements. However, the General Conditions also enable a structured and objective comparison between different providers. The BSI recommends regularly requesting C5 reports, evaluating them for the specific use case, and agreeing on compliance in the contract.
Organizations with increased security needs should also take a closer look at the Additional Criteria: By working with a qualified consultant, they can determine which of these criteria are relevant to their specific use case and which providers already meet them.
Its close alignment with European standards (EUCS, NIS2, ISO/IEC 27001:2022) ensures that C5:2026 is future-proof. Those who rely on C5-compliant services today are optimally prepared for upcoming regulatory requirements. For federal-level government agencies, the BSI minimum standard for the use of external Cloud-Services that explicitly require C5 compliance.
Please contact us!
Would you like to know which C5:2026 requirements apply to your Cloud-Are you interested in which aspects of infrastructure are relevant, or how you can apply the standard when selecting providers and managing suppliers? We can assist you with the analysis and implementation.
Source: BSI Cloud Computing Compliance Criteria Catalog (C5:2026), Federal Office for Information Security
Important Questions
What is BSI C5:2026?
BSI C5:2026 is the new Cloud Computing Compliance Criteria Catalog of the Federal Office for Information Security. It defines minimum requirements for the information security of Cloud-services and serves as a structured foundation for companies to Cloud-Providers, security controls, transparency disclosures, and Audit-to evaluate reports in a comparable manner.
Why is BSI C5:2026 important for companies when selecting a cloud provider?
The BSI C5:2026 helps companies, Cloud-Services not only based on features or price, but on robust security and Compliance-criteria. A C5 certification can serve as important evidence in supplier and risk management, particularly when it comes to personal data, sensitive business data, KRITIS-related matters, NIS 2 requirements, or situations requiring a high level of protection.
What has changed in C5:2026 compared to C5:2020?
C5:2026 expands the previous standard to include new technical criteria and a structure with a stronger European focus. New or more heavily emphasized areas include container management, supply chain management, post-quantum cryptography, confidential computing, digital sovereignty, more precise data categories, and a clearer structure for the basic and supplementary criteria.
What is the difference between a C5 Type 1 report and a Type 2 report?
A C5 Type 1 report assesses whether the controls described are appropriate as of a specific date. A Type 2 report additionally verifies whether these controls were actually effective over a period of at least three and no more than twelve months. For recurring audits, the Type 2 report is therefore particularly meaningful.
Do companies need to simply request C5 reports, or do they also need to analyze them?
Companies should not merely file C5 reports, but rather evaluate them in light of their specific use case. It is important to determine whether the audited controls align with the company’s own security needs, the data being processed, regulatory requirements, contractual risks, and internal security policies. Of particular importance are the General Conditions, additional criteria, and notes regarding data deletion, requests from authorities, locations, and Availability.
Who helps companies assess BSI C5:2026, cloud providers, and supplier risks?
2B Advice helps companies meet C5:2026 requirements for Cloud-Infrastructure, supplier management, Data protection, Compliance and risk management. This includes analyzing C5 reports, evaluating relevant basic and supplementary criteria, integrating them into third-party risk management, and Documentation from Cloud- and supplier risks.
German 
English 
Italian 
French