For cloud providers, SaaS & regulated cloud users
BSI C5 Consulting: Pass the Audit, Win the Tender
Keep your KRITIS and health-sector customers through the switch to C5:2026. Our BSI C5 consulting prepares cloud providers for the C5 attestation and helps public authorities, KRITIS operators and regulated companies implement the customer-side C5 criteria in a verifiable way. Backed by BSI C5 and IT-Grundschutz experience from public-sector projects.
C5:2026 is here: switch in time, stay eligible
In public-sector tenders, with health insurers and health data (Section 393 SGB V) and at KRITIS operators, your cloud is measured against C5: the BSI Cloud Computing Compliance Criteria Catalogue is Germany’s benchmark for cloud security, and more and more companies use it to assess their cloud suppliers. At the end of March 2026 the BSI published C5:2026: new criteria on container management, tenant separation, confidential computing, post-quantum cryptography and the supply chain, structurally aligned with ISO 27001:2022, NIS2 and the European EUCS scheme.
If you are a provider attested against C5:2020, move your internal control system to C5:2026 in good time before the cut-off date (1 June 2027). If you use the cloud, the corresponding criteria (what you must deliver on your side of the shared responsibility model) become more concrete and more auditable.
Either way, you get an attestation or evidence that holds up with the auditor, the assessor and in procurement: pragmatic and technically grounded, for providers and customers alike.
Provider or cloud customer? Your route to C5
For cloud providers & SaaS companies
You need a C5 attestation (Type 1 or Type 2) because customers, tenders or supervisors require it — or you need to migrate from C5:2020 to C5:2026.
You get: Gap analysis, readiness program, setup and documentation of the internal control system, system description, environment information, pre-audit, support during the audit.
For cloud customers: public authorities, KRITIS, regulated companies
You use Azure, AWS, Google Cloud or a sovereign platform and must prove that your usage is C5-compliant — to internal audit, data protection, supervisors or the procurement office.
You get: Assessment of your providers’ C5 reports, implementation of the corresponding criteria in your landing zone and operations, control evidence, requirements catalogue for procurement.
From first gap report to lasting compliance
1. C5 gap analysis (2–3 weeks): know effort and timeline
Know exactly where you stand: we compare your existing controls, processes and documentation with the 17 criteria areas of C5, against C5:2020, C5:2026 or as a delta analysis for the transition. We assess the design and effectiveness of each control, not just its existence.
You get: Gap report per criterion with maturity level, risk assessment, effort estimate and prioritized action plan; decision paper for a Type 1 vs. Type 2 attestation and timeline.
2. C5 readiness program (3–9 months): close your gaps
Turn gaps into working controls: we build or harden the ISMS and the internal control system, implement the technology (identity & access, cryptography and key management, logging/monitoring, tenant separation, backup, incident processes, supplier management) and deliver policies, system description and environment information in the form the auditor expects.
You get: Audit-ready control system with evidence, control owners and RACI; automated evidence collection wherever possible.
3. Pre-audit & attestation support: test before the auditor does
You go into the audit rehearsed: internal pre-audit following audit logic (IDW PS 951 / ISAE 3000), preparation of interviewees and evidence, support during the audit and follow-up on findings.
You get: Fewer findings, fewer re-audits, an attestation that customers and supervisors accept.
4. C5 for cloud customers: prove your share of controls
Close the gap your provider’s attestation leaves open: we read your providers’ C5 reports, identify the controls that sit with you (configuration, identities, keys, logging, data classification, business continuity) and implement them as code in your Azure, AWS, GCP or sovereign landing zone, verifiable and repeatable.
You get: C5 customer concept, implemented controls, evidence documentation for internal audit and supervisors. Closely linked to our sovereign cloud consulting.
5. Continuous compliance & managed services: stay attested
No scramble before every audit: policy-as-code, continuous compliance monitoring, drift detection and annual re-assessments, optionally as a managed service, so the Type 2 audit period brings no surprises.
Cover C5, ISO 27001, IT-Grundschutz and NIS2 in one go
Hardly any organization faces C5 alone. You avoid duplicate work, because we build your control system so that one piece of evidence serves several requirements at once:
- ISO 27001:2022 — C5:2026 is structurally aligned; your existing ISMS gives you a head start on the C5 readiness program.
- IT-Grundschutz — for public authorities and public IT service providers we map C5 criteria to IT-Grundschutz modules (in particular OPS.2.2 Cloud Usage), see our article on ISO 27001 based on IT-Grundschutz.
- NIS2 / NIS2UmsuCG — the risk management measures under Section 30 BSIG and the supply chain obligations can largely be evidenced with C5 controls; more in our NIS2 consulting.
- GDPR — C5 covers data protection as a separate criteria area; we build the data protection impact assessment for cloud projects directly on it.
Your path to attestation in five steps
- Kick-off & scoping: You get clarity on audit scope (services, locations, tenants), target version (C5:2020/C5:2026), attestation type, timeline and choice of auditor.
- Gap analysis: Interviews, document review, technical sampling; gap report and action plan.
- Implementation: Technical and organizational measures, documentation, evidence automation — in sprints, with visible progress per criteria area.
- Pre-audit: Internal review following auditor logic, interview training, remediation.
- Attestation & operations: Support during the audit; afterwards continuous compliance for the Type 2 period.
Why Insight42 for BSI C5: less risk on audit day
- Technology and compliance from one source. Your controls actually work and evidence is created automatically: we don’t just write policies, we configure identity, encryption, logging and landing zones ourselves.
- Experience with BSI C5 and IT-Grundschutz in public-sector projects; familiar with procurement requirements, the DVC context and auditors’ expectations.
- Independent of the auditor. We do not issue attestations ourselves and therefore have no interest in a “mild” pre-audit — we prepare you for the strict case.
- German company, based in Ingolstadt. Documentation in German or English, German contract basis, European standards.
Your BSI C5 questions, answered
C5 certification or C5 attestation — which is correct?
Formally there is no “C5 certification”. C5 is attested by an auditor through an audit under IDW PS 951 or ISAE 3000. The market uses both terms synonymously; in tenders you should require a “C5 attestation Type 2”.
Type 1 or Type 2?
Type 1 confirms the appropriateness of the controls at a reference date, Type 2 their effectiveness over a period (usually at least six months). Public authorities and KRITIS operators almost always require Type 2; Type 1 is a sensible intermediate step.
How long does it take to get a C5 attestation?
With an existing ISMS typically 6–12 months to Type 1, followed by the Type 2 audit period. Without an ISMS correspondingly longer. The gap analysis delivers a reliable timeline within 2–3 weeks.
What changes for us with C5:2026?
New or tightened criteria on container orchestration, tenant separation, confidential computing, cryptography (incl. post-quantum readiness) and the supply chain, as well as closer alignment with ISO 27001:2022 and NIS2. For audit periods ending on or after 1 June 2027, C5:2026 is the benchmark recommended by the BSI — the internal control system should be switched well before that. We deliver a C5:2020 → C5:2026 delta analysis for this.
We only use Azure/AWS — does that make us automatically C5-compliant?
No. The hyperscaler’s attestation covers its own area of responsibility. Configuration, identities, keys, logging and data classification are your responsibility and must be evidenced separately.
Where are you on the way to a C5 attestation?
In a 30-minute readiness call you get clarity on audit scope, target version and a realistic timeline, and on whether a gap analysis is the right next step.
Why Insight42
- Pass audits with less effort: architectures aligned with BSI C5, NIS2 and GDPR from day one, for enterprises and public-sector organizations in Germany and Europe.
- One accountable team: assessment, architecture, implementation and operations from one source. No hand-offs, no finger-pointing, less coordination for you. Founded and led by Martin-Peter Lambert in Ingolstadt.
- Results that run in production: we build and run our own products (Secretary42, Unimatrix-OI, InheritanceVault) and bring the same discipline to your project.
- You stay in control: data residency, key custody (BYOK/HYOK) and a documented exit strategy are built in from day one, not bolted on later.