You have decided on BSI C5. Implementation is underway. Now comes the audit. How do you prepare? What can you expect? This article is the practical follow-up to our BSI C5 Cloud Certification guide and walks through documentation, evidence, typical findings and interview preparation.
The Audit is Approaching
BSI C5 audits are thorough. Auditors want to see evidence — not just documents, but also established practices. Since April 2026 the reference catalogue is C5:2026; if your attestation period starts after mid-2027, prepare against the new criteria (container management, tenant isolation, confidential computing, post-quantum cryptography, supply chain).
Documentation is Everything
No attestation without documentation. Auditors can only audit what is documented. Every control needs evidence. Every process needs a description.
What must be documented:
Security policies and their approval, process descriptions with responsibilities, configuration standards and their implementation, employee training records, and logs as proof.
The Most Common Audit Findings
Preparation also means avoiding mistakes. These findings are common:
Incomplete Documentation
Controls exist but are not documented, or the documentation is outdated. Solution: Keep documentation current by automating evidence collection from your cloud platform, so reality and documentation stay in sync.
Missing Evidence
Processes are followed but not logged. Solution: Enable logging and recording.
Inconsistent Implementation
Policies exist but are not followed. Solution: Conduct regular internal audits.
Unclear Responsibilities
No one feels responsible. Solution: Create a RACI matrix.
Quick Checklist: Audit Preparation
| Document | Content | Current? |
| ISMS Manual | Overall Security Overview | ☐ |
| Security Policies | All Policies | ☐ |
| Risk Analysis | Current Assessment | ☐ |
| Asset Register | Complete Inventory | ☐ |
| Access Matrix | Permissions Documented | ☐ |
| Incident Log | Incidents Logged | ☐ |
| Training Records | All Employees | ☐ |
| Audit Trail | Changes Traceable | ☐ |
To-Do List for Audit Readiness
- 8 weeks prior: Fully review documentation.
- 6 weeks prior: Conduct an internal pre-audit.
- 4 weeks prior: Remediate findings.
- 2 weeks prior: Compile evidence.
- 1 week prior: Brief interview partners.
- Audit Day: Stay calm, cooperate.
- After Audit: Remediate findings promptly.
The BSI-Compliant Cloud Security Concept
The security concept is the centrepiece. It comprehensively describes your cloud security. Auditors will read it carefully.
Contents of the Security Concept:
Scope and demarcation of cloud use, risk analysis and assessment, technical and organisational measures, responsibilities and processes, and emergency and business continuity management.
IT baseline protection consulting helps with its creation. ISO 27001 based on IT-Grundschutz provides the structure. The result: an audit-proof document.
Mastering Interviews
Auditors conduct interviews. They want to understand how controls are put into practice. Brief every interview partner on their controls, the evidence that backs them and the process for exceptions — preparation is of the utmost importance.
Continuous Compliance
BSI C5 is not a one-time project; it is a continuous process. After the audit is before the audit — especially for a Type 2 attestation, where the controls must demonstrably work throughout the audit period.
Cloud managed services for authorities help with this through continuous monitoring, regular reviews, and automated compliance checks. Azure and GCP native tooling provides dashboards showing compliance status and alerts for deviations.
Insight42 Audit Support
We guide you through the audit: preparation, execution, and follow-up, with experienced consultants by your side. We create the BSI-compliant cloud security concept together with you and implement the technical controls that back it.
Pass your audit. See our BSI C5 Beratung (German) or contact us to book a C5 readiness call.