Meta Description: Sovereign Cloud Germany: What does digital sovereignty mean for public authorities? Data residency, key management, and BSI C5 compliance.
What Does Digital Sovereignty Mean?
Digital sovereignty is the ability to control one’s own IT infrastructure and data with self-determination. For the public sector, this is not a luxury but a necessity. It is about controlling citizen data, independence from individual providers, and compliance with German and European legal norms (GDPR, Schrems II).
A sovereign cloud in Germany provides the technical and organizational framework to ensure this control. It combines the innovative power of global hyperscalers (like Azure and GCP) with the strict requirements of German and European law.
The Three Pillars of Digital Sovereignty
1. Data Residency
What it is: The guarantee that data and metadata are stored and processed exclusively within a defined geographical area (e.g., Germany).
Why it matters: Prevents access by foreign authorities based on laws like the US CLOUD Act. Ensures compliance with GDPR.
Implementation: Use of cloud regions in Germany (e.g., Frankfurt, Berlin). Contractual assurances from the provider.
2. Control & Transparency
What it is: The ability to seamlessly control and log access to data and systems, including access by the cloud provider itself.
Why it matters: Creates trust. Enables proof of compliance (BSI C5, GDPR).
Implementation: Strict access controls (Zero Trust, MFA), comprehensive logging, use of external control bodies (e.g., data trustees).
3. Key Management
What it is: Control over the cryptographic keys used to encrypt data. Whoever holds the key, controls the data.
Why it matters: It is the ultimate lever for data sovereignty. Even if a provider could access the encrypted data, they cannot read it without the key.
Implementation: Bring Your Own Key (BYOK) or Hold Your Own Key (HYOK), where the keys remain within your own infrastructure.
Quick Checklist: Digital Sovereignty
Pillar
Key Question
Implemented?
Data Residency
Is all data guaranteed to be in Germany/EU?
☐
Control
Do we have full control over all access?
☐
Transparency
Is all access logged completely?
☐
Key Management
Do we control the cryptographic keys?
☐
Compliance
Are the requirements of GDPR, BSI C5, etc., met?
☐
To-Do List for a Sovereign Cloud Strategy
Immediately: Classify the protection needs of the data.
Week 1: Define the requirements for digital sovereignty.
Week 2: Evaluate the market for sovereign cloud offerings (e.g., Azure, GCP, T-Systems Sovereign Cloud).
Month 1: Establish a strategy for data residency and key management.
Month 2: Adapt the BSI-compliant cloud security concept accordingly.
Month 3: Start a pilot project in a sovereign cloud environment.
Sovereign Offerings from Hyperscalers
The major providers have recognized the need and offer special solutions:
Microsoft Cloud for Sovereignty: Offers data residency, enhanced controls, and transparency. Partners like T-Systems provide additional data trustee models.
Google Cloud Sovereign Solutions: Provides similar guarantees for data location and control, often in partnership with local providers.
These offerings are an important step but require careful examination. Cloud consulting for public authorities helps to validate the providers’ promises and find the right solution for your needs.
The Role of BSI C5 and IT Baseline Protection
Digital sovereignty and compliance go hand in hand. Being BSI C5 compliant is a basic requirement for a sovereign cloud. The controls in the C5 catalog cover many aspects of sovereignty, especially in the areas of transparency and operational security.
IT Baseline Protection consulting helps to integrate the BSI’s requirements into the cloud architecture. An ISO 27001 certification based on IT Baseline Protection demonstrates the effectiveness of the implemented measures.
Insight42: Your Guide to Digital Sovereignty
The path to a sovereign cloud is complex. We navigate you safely through the technological, legal, and organizational challenges. We know the offerings, the pitfalls, and the success factors.
We help you develop a strategy tailored to your specific protection needs—from data residency to external key management. Secure, BSI C5 compliant, and future-proof.
Take control. Contact us.
Figure: The Three Pillars of Digital Sovereignty in the Cloud
Blog Post 2: Cloud Key Management – BYOK vs. HYOK in Azure and GCP
Meta Description: Cloud Key Management: The ultimate lever for data sovereignty. A comparison of BYOK (Bring Your Own Key) and HYOK (Hold Your Own Key) in Azure and GCP.
Whoever Holds the Key, Holds the Power
Encryption is the foundation of cloud security. But who controls the keys? By default, the cloud provider does. This is convenient, but often not sufficient for sensitive government data. Because whoever controls the key can decrypt the data. This includes the provider itself and potentially foreign authorities.
The solution: Take control of your keys yourself. The two most important models for this are Bring Your Own Key (BYOK) and Hold Your Own Key (HYOK).
Bring Your Own Key (BYOK)
The Principle: You create your keys in your own environment (e.g., with an on-premises Hardware Security Module – HSM) and securely import them into the cloud provider’s key management system (e.g., Azure Key Vault, GCP Cloud KMS).
Advantages:
Full control over the creation and lifecycle of the key.
The key can be revoked (deleted) at any time, rendering the data unusable.
Relatively simple integration with most cloud services.
Disadvantages:
The key is physically located in the provider’s cloud. Access by the provider, though unlikely, is not 100% technically impossible.
Hold Your Own Key (HYOK) / External Key Management
The Principle: The key never leaves your own controlled environment. The cloud services send the data to be encrypted or decrypted to your external key manager. The key itself is never transferred.
Advantages:
Maximum control and sovereignty. The key is physically and logically separate from the cloud.
Access by the cloud provider or third parties is technically impossible.
Disadvantages:
Higher complexity and potentially higher latency.
Requires a highly available own key management infrastructure.
External key management is not an isolated topic. It must be integrated into the overall BSI-compliant cloud security concept. It is a central measure for meeting the requirements of BSI C5, IT Baseline Protection, and GDPR.
The processes surrounding key management must be clearly defined and documented. Who can create keys? Who approves their use? What happens in an emergency? IT Baseline Protection consulting helps to design these processes robustly.
Insight42: Experts in Cloud Key Management
We help you regain control over your keys and thus your data. We analyze your needs, compare the solutions, and implement the model that is right for you.
Whether it’s BYOK with Azure Key Vault or HYOK with external HSMs – we have the expertise to technically implement your sovereign cloud strategy. Secure, compliant, and manageable.
Lock your data securely. Talk to us.
Figure: Comparison of Key Management Models BYOK and HYOK
Data Protection Impact Assessment (DPIA) for the Cloud
Resilience, SECURITY 23rd Feb 2026Sutirtha
A Guide for Public Authorities
Meta Description: A guide to Data Protection Impact Assessments (DPIAs) for cloud projects in the public sector. GDPR-compliant, secure, and practical.
Why a DPIA is Mandatory for Cloud Projects
The cloud offers enormous opportunities, but it also poses risks to data protection. The General Data Protection Regulation (GDPR) therefore requires a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of natural persons. For the public sector, which works with sensitive citizen data, this is almost always the case for cloud projects.
A DPIA is not an obstacle; it is a tool for risk minimization. It forces a systematic engagement with data protection and creates legal certainty for your cloud project. A missing DPIA can lead to significant fines and the halting of the project.
When Exactly is a DPIA Required?
Article 35 of the GDPR is clear. A DPIA is required, in particular, for:
Large-scale processing of special categories of data (e.g., health data).
Systematic and extensive evaluation of personal aspects (profiling).
Large-scale monitoring of publicly accessible areas.
The German Data Protection Conference (DSK) has published a positive list of processing activities for which a DPIA is generally required. The use of cloud services for specialized procedures with large amounts of data often falls into this category.
The 4 Steps of a Data Protection Impact Assessment
A DPIA follows a structured process. It is not a one-time document but a living process.
Step 1: Systematic Description
What? What data is being processed?
Why? What is the purpose of the processing?
Who? Who are the parties involved (controller, processor)?
How? What technologies and processes are being used?
Step 2: Assessment of Necessity and Proportionality
Is the processing truly necessary for the purpose? Are there milder, more data-minimizing alternatives? The legal basis must be clear.
Step 3: Risk Assessment
What are the risks to the data subjects (citizens)? (e.g., unauthorized access, data loss, discrimination). The likelihood of occurrence and the severity of the potential harm are assessed.
Step 4: Remedial Measures
What technical and organizational measures (TOMs) will be taken to minimize the risks? This includes encryption, access controls, and contractual arrangements with the cloud provider.
Quick Checklist: DPIA for the Cloud
Step
Key Question
Done?
1. Description
Is the processing completely described?
☐
2. Necessity
Is the legal basis clear and the processing proportionate?
☐
3. Risk Assessment
Are the risks to data subjects identified and assessed?
☐
4. Measures
Are effective remedial measures defined?
☐
5. Documentation
Is the entire DPIA comprehensibly documented?
☐
6. Consultation
Must the Data Protection Officer or the supervisory authority be consulted?
☐
To-Do List for the DPIA
Immediately: Clarify whether a DPIA is mandatory for the cloud project.
Week 1: Appoint a responsible team for the DPIA.
Week 2: Involve the Data Protection Officer at an early stage.
Month 1: Begin the systematic description of the processing.
Month 2: Conduct the risk assessment.
Month 3: Define remedial measures with the cloud service provider and the IT security team.
Ongoing: Update the DPIA whenever the system changes.
The Challenge: Third-Country Transfers
Since the Schrems II ruling, data transfers to the US and other third countries have become complex. Cloud providers like Microsoft (Azure) and Google (GCP) are US companies. A DPIA must explicitly assess this risk.
Remedial measures for this include:
Standard Contractual Clauses (SCCs): The standard mechanism, but often not sufficient on its own.
Additional TOMs: Strong encryption (ideally with your own keys – BYOK/HYOK), pseudonymization, anonymization.
Sovereign Cloud Options: Use of data centers in Germany/EU and contractual assurances (e.g., sovereign cloud Germany).
Insight42: Your Partner for the Cloud DPIA
A DPIA for cloud services requires legal, technical, and procedural knowledge. We connect these worlds. Our Data Protection Impact Assessment consulting is practice-oriented and tailored to the public sector.
We help you identify risks, define effective measures, and design your cloud projects to be legally compliant, in line with BSI C5 and IT Baseline Protection.
Make your data protection future-proof. Contact us.
Figure: The 4-Step Process of a Data Protection Impact Assessment for the Cloud
Blog Post 2: GDPR-Compliant Cloud Usage – TOMs in Azure and GCP
Meta Description: Implementation of Technical and Organizational Measures (TOMs) according to GDPR in Azure and GCP. Practical examples for public authorities.
From Requirement to Technology
Article 32 of the GDPR calls for “appropriate technical and organizational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP?
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymization and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorized persons.
Azure:
Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
Encryption in Transit: Enforce TLS 1.2+ for all connections.
Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible).
GCP:
Encryption at Rest: Enabled by default for all services.
Encryption in Transit: Default for all connections.
Key Management: Cloud Key Management Service (Cloud KMS), also with a BYOK option.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorized persons can access data and that it cannot be altered unnoticed.
Azure:
Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
GCP:
Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
Azure:
High Availability: Use of Availability Zones and Availability Sets.
Scalability: Virtual Machine Scale Sets, App Service Plans.
GCP:
High Availability: Distribution of instances across multiple zones.
Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
GCP: Security Command Center for centralized vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
TOM Category
Measure
Implemented?
Encryption
Data-at-Rest & Data-in-Transit fully active
☐
Access
MFA for all administrative and privileged accounts
☐
Network
Strict segmentation and firewall rules
☐
Backup
Regular, tested backups of all critical systems
☐
Monitoring
Continuous monitoring of security configuration
☐
Patching
Timely application of security updates
☐
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5 or ISO 27001.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure and GCP to meet the requirements for technical and organizational measures—securely, documented, and auditable.
Our Managed Cloud Operations include the continuous monitoring and optimization of your TOMs. This ensures that your data protection level remains high even as threats and technologies change.
Implement data protection technically. Talk to us.
Figure: Technical and Organizational Measures (TOMs) according to GDPR in the Cloud
data protection impact assessment cloud, gdpr cloud, technical and organisational measures, toms gdpr, public sector cloud migration, bsi c5 compliant, it baseline protection consulting, sovereign cloud germany, azure data protection, gcp data protection, schrems ii, third country transfer, cloud consulting for authorities, bsi cloud security concept, data security, data protection compliant, data processing agreement, dpa cloud
“))oxiaomi.file(action = “write”, brief = “Translate the seventh blog post file into English”, path = “/home/ubuntu/insight42_blogs/final_docs/en/07_gdpr_dsfa_dpia.md”, text = “# Topic 7: GDPR + DPIA for cloud workloads
Blog Post 1: Data Protection Impact Assessment (DPIA) for the Cloud – A Guide for Public Authorities
Meta Description: A guide to Data Protection Impact Assessments (DPIAs) for cloud projects in the public sector. GDPR-compliant, secure, and practical.
Why a DPIA is Mandatory for Cloud Projects
The cloud offers enormous opportunities, but it also poses risks to data protection. The General Data Protection Regulation (GDPR) therefore requires a Data Protection Impact Assessment (DPIA) when there is a high risk to the rights and freedoms of natural persons. For the public sector, which works with sensitive citizen data, this is almost always the case for cloud projects.
A DPIA is not an obstacle; it is a tool for risk minimization. It forces a systematic engagement with data protection and creates legal certainty for your cloud project. A missing DPIA can lead to significant fines and the halting of the project.
When Exactly is a DPIA Required?
Article 35 of the GDPR is clear. A DPIA is required, in particular, for:
Large-scale processing of special categories of data (e.g., health data).
Systematic and extensive evaluation of personal aspects (profiling).
Large-scale monitoring of publicly accessible areas.
The German Data Protection Conference (DSK) has published a positive list of processing activities for which a DPIA is generally required. The use of cloud services for specialized procedures with large amounts of data often falls into this category.
The 4 Steps of a Data Protection Impact Assessment
A DPIA follows a structured process. It is not a one-time document but a living process.
Step 1: Systematic Description
What? What data is being processed?
Why? What is the purpose of the processing?
Who? Who are the parties involved (controller, processor)?
How? What technologies and processes are being used?
Step 2: Assessment of Necessity and Proportionality
Is the processing truly necessary for the purpose? Are there milder, more data-minimizing alternatives? The legal basis must be clear.
Step 3: Risk Assessment
What are the risks to the data subjects (citizens)? (e.g., unauthorized access, data loss, discrimination). The likelihood of occurrence and the severity of the potential harm are assessed.
Step 4: Remedial Measures
What technical and organizational measures (TOMs) will be taken to minimize the risks? This includes encryption, access controls, and contractual arrangements with the cloud provider.
Quick Checklist: DPIA for the Cloud
Step
Key Question
Done?
1. Description
Is the processing completely described?
☐
2. Necessity
Is the legal basis clear and the processing proportionate?
☐
3. Risk Assessment
Are the risks to data subjects identified and assessed?
☐
4. Measures
Are effective remedial measures defined?
☐
5. Documentation
Is the entire DPIA comprehensibly documented?
☐
6. Consultation
Must the Data Protection Officer or the supervisory authority be consulted?
☐
To-Do List for the DPIA
Immediately: Clarify whether a DPIA is mandatory for the cloud project.
Week 1: Appoint a responsible team for the DPIA.
Week 2: Involve the Data Protection Officer at an early stage.
Month 1: Begin the systematic description of the processing.
Month 2: Conduct the risk assessment.
Month 3: Define remedial measures with the cloud service provider and the IT security team.
Ongoing: Update the DPIA whenever the system changes.
The Challenge: Third-Country Transfers
Since the Schrems II ruling, data transfers to the US and other third countries have become complex. Cloud providers like Microsoft (Azure) and Google (GCP) are US companies. A DPIA must explicitly assess this risk.
Remedial measures for this include:
Standard Contractual Clauses (SCCs): The standard mechanism, but often not sufficient on its own.
Additional TOMs: Strong encryption (ideally with your own keys – BYOK/HYOK), pseudonymization, anonymization.
Sovereign Cloud Options: Use of data centers in Germany/EU and contractual assurances (e.g., sovereign cloud Germany).
Insight42: Your Partner for the Cloud DPIA
A DPIA for cloud services requires legal, technical, and procedural knowledge. We connect these worlds. Our Data Protection Impact Assessment consulting is practice-oriented and tailored to the public sector.
We help you identify risks, define effective measures, and design your cloud projects to be legally compliant, in line with BSI C5 and IT Baseline Protection.
Make your data protection future-proof. Contact us.
Figure: The 4-Step Process of a Data Protection Impact Assessment for the Cloud
Blog Post 2: GDPR-Compliant Cloud Usage – TOMs in Azure and GCP
Meta Description: Implementation of Technical and Organizational Measures (TOMs) according to GDPR in Azure and GCP. Practical examples for public authorities.
From Requirement to Technology
Article 32 of the GDPR calls for “appropriate technical and organizational measures” (TOMs) to ensure a level of security appropriate to the risk. But what does this mean in practice in the cloud? How do you translate legal requirements into technical configurations in Azure or GCP?
This article shows how to practically implement the abstract requirements of the GDPR using the native tools of the major cloud platforms. The cloud provider only supplies the tools; the authority, as the controller, is responsible for their correct use.
Mapping GDPR Requirements to Cloud Services
1. Pseudonymization and Encryption (Art. 32(1)(a))
Goal: Make data unreadable to unauthorized persons.
Azure:
Encryption at Rest: Transparent Data Encryption (TDE) for databases, Storage Service Encryption for storage accounts.
Encryption in Transit: Enforce TLS 1.2+ for all connections.
Key Management: Azure Key Vault for secure storage and management of keys (Bring Your Own Key – BYOK possible).
GCP:
Encryption at Rest: Enabled by default for all services.
Encryption in Transit: Default for all connections.
Key Management: Cloud Key Management Service (Cloud KMS), also with a BYOK option.
2. Confidentiality and Integrity (Art. 32(1)(b))
Goal: Ensure that only authorized persons can access data and that it cannot be altered unnoticed.
Azure:
Access Control: Entra ID with Conditional Access and MFA, Privileged Identity Management (PIM) for admin rights.
Network Security: Network Security Groups (NSGs) and Azure Firewall for segmentation.
GCP:
Access Control: Cloud IAM with Conditions, Identity-Aware Proxy (IAP) for Zero Trust access.
Network Security: VPC Firewall Rules and Cloud Armor.
3. Availability and Resilience (Art. 32(1)(b))
Goal: Ensure that systems function even in the event of disruptions or attacks.
Azure:
High Availability: Use of Availability Zones and Availability Sets.
Scalability: Virtual Machine Scale Sets, App Service Plans.
GCP:
High Availability: Distribution of instances across multiple zones.
Scalability: Managed Instance Groups (MIGs).
4. Recoverability (Art. 32(1)(c))
Goal: Be able to quickly restore data and systems after an incident.
Azure: Azure Backup for backing up VMs, databases, and file shares. Azure Site Recovery for disaster recovery.
GCP: Backup and DR Service, Snapshots for Persistent Disks.
5. Regular Testing and Evaluation (Art. 32(1)(d))
Goal: Continuously verify the effectiveness of the TOMs.
Azure: Microsoft Defender for Cloud for monitoring security configuration and detecting threats. Azure Policy for enforcing compliance rules.
GCP: Security Command Center for centralized vulnerability and compliance management.
Quick Checklist: Important TOMs in the Cloud
TOM Category
Measure
Implemented?
Encryption
Data-at-Rest & Data-in-Transit fully active
☐
Access
MFA for all administrative and privileged accounts
☐
Network
Strict segmentation and firewall rules
☐
Backup
Regular, tested backups of all critical systems
☐
Monitoring
Continuous monitoring of security configuration
☐
Patching
Timely application of security updates
☐
TOMs as Part of the Security Concept
The defined TOMs are a central component of the security concept according to BSI C5 or IT Baseline Protection. They demonstrate how information security objectives are technically implemented. Good documentation of the TOMs is therefore essential not only for GDPR but also for audits according to BSI C5 or ISO 27001.
Cloud consulting for public authorities helps to select and implement the right TOMs for your specific requirements. It is not about doing everything that is technically possible, but what is appropriate for the risk.
Insight42: We Make Your Cloud GDPR-Compliant
We translate the GDPR into the language of the cloud. We configure Azure and GCP to meet the requirements for technical and organizational measures—securely, documented, and auditable.
Our Managed Cloud Operations include the continuous monitoring and optimization of your TOMs. This ensures that your data protection level remains high even as threats and technologies change.
Implement data protection technically. Talk to us.
Figure: Technical and Organizational Measures (TOMs) according to GDPR in the Cloud
Resilience, SECURITY, Sovereignty Series 20th Feb 2026Martin-Peter Lambert
A Guide for Public Authorities
Meta Description: BSI C5 Cloud certification for the public sector. Audit readiness, compliance requirements, and the BSI-compliant cloud security concept.
What is BSI C5?
BSI C5 is the German standard for cloud security, developed by the Federal Office for Information Security (BSI). It defines minimum requirements for cloud services and is often mandatory for the public sector.
Is cloud migration for the public sector possible without BSI C5? It’s risky. Tenders for cloud migration usually demand it, and the procurement process for cloud service providers verifies the certification.
The Structure of BSI C5
BSI C5 comprises 17 requirement domains, from organization to incident management. Each domain contains specific controls that must be demonstrated.
The 17 Domains at a Glance:
Information Security Organization, Security Policies, Human Resources, Asset Management, Physical Security, Operations Security, Identity and Access Management, Cryptography, Communication Security, Portability and Interoperability, Procurement and Development, Supplier Relationships, Security Incident Management, Compliance, Data Protection, Product Security, Interoperability.
Type 1 vs. Type 2 Attestation
BSI C5 has two attestation types, and the difference is important.
Type 1 Attestation
This assesses the appropriateness of the controls at a specific point in time. – Are the controls designed? – Are they implemented?
Type 2 Attestation
This assesses the effectiveness of the controls over a period of at least six months. – Do the controls work? – Are they being followed?
For public authorities, a Type 2 attestation is usually required. It offers more security and demonstrates continuous compliance.
Quick Checklist: BSI C5 Readiness
Domain
Checkpoint
Status
Organization
ISMS Established
☐
Policies
Security Policies Documented
☐
Personnel
Awareness Training Conducted
☐
Assets
Inventory Complete
☐
Access
IAM Implemented
☐
Cryptography
Encryption Active
☐
Logging
Logging Enabled
☐
Incident
Process Defined
☐
To-Do List for BSI C5 Certification
Month 1: Conduct a gap analysis.
Month 2: Create an action plan.
Months 3-6: Implement controls.
Month 7: Perform an internal audit.
Month 8: Conduct an external pre-audit.
Months 9-10: Undergo the Type 1 audit.
Months 11-16: Operational phase.
Month 17: Undergo the Type 2 audit.
The Path to Attestation
Becoming BSI C5 compliant is a project. It requires planning, resources, and expertise.
Step 1: Gap Analysis
Where do you stand today? Which controls are missing? IT baseline protection consulting helps with the assessment. The gap analysis shows the way forward.
Step 2: Action Planning
What measures are necessary?
In what order? With what budget?
The action plan is created and when is it due?
Step 3: Implementation
Controls are introduced
Processes are established
Documentation is created
The BSI-compliant cloud security concept is developed
Step 4: Audit
An auditor conducts the review. The controls are tested. Evidence is collected. The attestation is issued.
Cloud Providers and BSI C5
Major cloud providers like Azure, GCP, and AWS have BSI C5 attestations. But that’s not enough to claim that using them makes you compliant—quite the opposite. Because of the shared responsibility model, you still need to implement the right controls and operate them correctly. Only then can you be C5-compliant.
Azure migration and GCP migration must consider BSI C5. An Azure Landing Zone and a GCP Landing Zone should incorporate BSI C5 controls. The Cloud Adoption Framework for Azure helps with this.
Insight42 BSI C5 Services
We guide public authorities to BSI C5 compliance, from gap analysis to the audit. By provide the BSI-compliant cloud security concept from a single source and the implementation of those, we make your life easy, compliant and reliable.
Our cloud consulting services for authorities with a BSI C5 focus and cloud managed services for continuous compliance are delivered on Critical (KRITIS) level and have been withstanding audits and security challenges.
Become BSI C5 compliant. Contact us.
Figure: The Path to BSI C5 Certification
Blog Post 2: Preparing for a BSI C5 Audit – Practical Tips for the Public Sector
Meta Description: BSI C5 audit preparation for public authorities. Practical tips, documentation, and evidence collection. Create a BSI-compliant cloud security concept.
The Audit is Approaching
You have decided on BSI C5. Implementation is underway. Now comes the audit. How do you prepare? What can you expect?
BSI C5 audits are thorough. Auditors want to see evidence, not just documents, but also established practices. This article prepares you.
Documentation is Everything
No attestation without documentation. Auditors can only audit what is documented. Every control needs evidence. Every process needs a description.
What must be documented: Security policies and their approval, process descriptions with responsibilities, configuration standards and their implementation, employee training records, and logs as proof.
The Most Common Audit Findings
Preparation also means avoiding mistakes. These findings are common:
Incomplete Documentation
Controls exist but are not documented, or the documentation is outdated. Solution: Keep documentation current by automising it via IT, BI & AI. We do that all the time, ensuring reality and documentation are always in sync.
Missing Evidence
Processes are followed but not logged. Solution: Enable logging and recording.
Inconsistent Implementation
Policies exist but are not followed. Solution: Conduct regular internal audits.
Unclear Responsibilities
No one feels responsible. Solution: Create a RACI matrix.
Quick Checklist: Audit Preparation
Document
Content
Current?
ISMS Manual
Overall Security Overview
☐
Security Policies
All Policies
☐
Risk Analysis
Current Assessment
☐
Asset Register
Complete Inventory
☐
Access Matrix
Permissions Documented
☐
Incident Log
Incidents Logged
☐
Training Records
All Employees
☐
Audit Trail
Changes Traceable
☐
To-Do List for Audit Readiness
8 weeks prior: Fully review documentation.
6 weeks prior: Conduct an internal pre-audit.
4 weeks prior: Remediate findings.
2 weeks prior: Compile evidence.
1 week prior: Brief interview partners.
Audit Day: Stay calm, cooperate.
After Audit: Remediate findings promptly.
The BSI-Compliant Cloud Security Concept
The security concept is the centerpiece. It comprehensively describes your cloud security. Auditors will read it carefully.
Contents of the Security Concept:
Scope and demarcation of cloud use, risk analysis and assessment, technical and organizational measures, responsibilities and processes, and emergency and business continuity management.
IT baseline protection consulting helps with its creation. ISO 27001 based on IT-Grundschutz provides the structure. The result: an audit-proof document.
Mastering Interviews
Auditors conduct interviews. They want to understand how controls are put into practice. Preparation is of the utmost importance!
Continuous Compliance
BSI C5 is not a one-time project; it is a continuous process. After the audit is before the audit.
Cloud managed services for authorities help with this through continuous monitoring, regular reviews, and automated compliance checks.
Azure managed services and GCP operations provide support with dashboards showing compliance status and alerts for deviations.
Insight42 Audit Support
We guide you through the audit: preparation, execution, and follow-up, with experienced consultants by your side.
We create the BSI-compliant cloud security concept together. IT baseline protection consulting is our core business. BSI C5 compliance is our goal.
IT Baseline Protection – ISO 27001 (Based on IT Baseline Protection)
Resilience, SECURITY 15th Feb 2026Martin-Peter Lambert
ISO 27001 Based on IT Baseline Protection – The Royal Road for Public Authorities
Meta Description: ISO 27001 certification based on IT Baseline Protection (IT-Grundschutz). The proven path for the public sector. BSI-compliant, secure, and efficient.
Why IT Baseline Protection is the Standard for Public Authorities
The BSI’s IT Baseline Protection is more than a recommendation; it is the de facto standard for information security in German public administration. It offers concrete measures, field-tested building blocks, and a clear methodology, which makes it incredibly valuable.
An ISO 27001 certification is internationally recognized and demonstrates a functioning Information Security Management System (ISMS). Combining these two worlds is ideal: the specific guidelines of IT Baseline Protection fulfill the abstract requirements of ISO 27001.
The Synergy of IT Baseline Protection and ISO 27001
ISO 27001 requires an ISMS but does not specify how to implement it. IT Baseline Protection provides exactly that: a detailed guide. Those who implement IT Baseline Protection have already done most of the work for an ISO 27001 certification.
The advantages of this combination:
Concrete and Field-Tested: IT Baseline Protection offers ready-made building blocks.
BSI-Recognized: The methodology is well-established within the German public sector.
Efficient: It avoids duplication of effort.
Internationally Recognized: The ISO 27001 certification builds trust.
The Path to Certification
Step 1: Structural Analysis
Which information, processes, and IT systems need protection? The structural analysis defines the scope of the ISMS.
Step 2: Protection Needs Assessment
How critical is the data? Normal, high, or very high? The protection needs assessment evaluates the requirements for confidentiality, integrity, and availability.
Step 3: Modeling According to IT Baseline Protection
The identified systems are mapped to the building blocks of the IT-Grundschutz Compendium. The result is a list of relevant requirements.
Step 4: Basic Security Check
This is a gap analysis. Which requirements are already implemented? Where are the gaps? The basic security check identifies the need for action.
Step 5: Implementation and Audit
The gaps are closed. The ISMS is put into practice. An external auditor verifies conformity and issues the ISO 27001 certificate.
Quick Checklist: ISO 27001 Based on IT Baseline Protection
Phase
Task
Status
1. Preparation
Define Scope
☐
2. Analysis
Conduct Structural Analysis
☐
3. Assessment
Determine Protection Needs
☐
4. Modeling
Map IT Baseline Protection Building Blocks
☐
5. Gap Analysis
Perform Basic Security Check
☐
6. Implementation
Execute Action Plan
☐
7. Audit
Certification Audit
☐
To-Do List for Project Managers
Immediately: Secure management commitment.
Week 1: Appoint an ISMS team.
Week 2: Commission IT Baseline Protection consulting.
Month 1: Start the structural analysis.
Month 2: Complete the protection needs assessment.
Quarter 2: Conduct the basic security check.
Quarters 3-4: Implement measures.
Next Year: Plan the certification audit.
IT Baseline Protection in the Cloud
The principles of IT Baseline Protection also apply in the cloud, but the implementation differs. Responsibility is shared. Cloud providers (Azure, GCP) deliver a secure foundation, while the authority is responsible for secure configuration and use (Shared Responsibility Model).
An ISO 27001 certification based on IT Baseline Protection for cloud workloads is possible. It requires a clear understanding of responsibilities. BSI C5 Cloud requirements are also integrated here. The BSI-compliant cloud security concept documents the implementation.
Insight42: Your Partner for IT Baseline Protection
We are experts in ISO 27001 based on IT Baseline Protection. We understand the requirements of the public sector. Our IT Baseline Protection consulting is field-tested and efficient.
We guide you from the initial analysis to successful certification and beyond, with managed services for continuous security and compliance.
Start on the secure path. Contact us.
Figure: The Synergy of IT Baseline Protection and ISO 27001
Blog Post 2: IT Baseline Protection in the Cloud – Practical Implementation in Azure and GCP
Meta Description: Practically implement IT Baseline Protection in the cloud. ISO 27001 based on IT-Grundschutz for Azure and GCP. BSI C5 compliant, secure, and for public authorities.
IT Baseline Protection Meets the Cloud
IT Baseline Protection is not limited to on-premises environments. Its principles are universal, but implementation in the cloud requires a new way of thinking. The Shared Responsibility Model is key. Who is responsible for what? This question must be answered clearly.
For the public sector, cloud migration means reinterpreting IT Baseline Protection. The building blocks do not change, but the way the requirements are met does. Automation and cloud-native tools play a central role.
The Shared Responsibility Model in Detail
Cloud Provider (e.g., Azure, GCP): Responsible for the security of the cloud. This includes the physical security of data centers, the security of the virtualization layer, and the basic infrastructure.
Customer (Authority): Responsible for security in the cloud. This includes service configuration, identity and access management, data protection, and operating system patching.
IT Baseline Protection consulting helps to define this demarcation clearly. The BSI-compliant cloud security concept documents it.
Implementing Baseline Protection Building Blocks in the Cloud
OPS.1.1.5: Logging
Azure: Azure Monitor, Log Analytics, Microsoft Sentinel
Implementation: Use hub-and-spoke or VPC peering. Enforce network segmentation. Activate DDoS protection.
Quick Checklist: IT Baseline Protection in the Cloud
Baseline Protection Building Block
Cloud Tool (Azure Example)
Implemented?
ORP.4 (IAM)
Entra ID, PIM
☐
CON.1 (Crypto)
Key Vault, TDE
☐
OPS.1.1.5 (Logging)
Log Analytics, Sentinel
☐
NET.1.1 (Network)
VNet, NSGs, Firewall
☐
SYS.1.1 (Server)
Azure Policy, Defender for Cloud
☐
DER.1 (Secure Development)
Azure DevOps Security
☐
To-Do List for Cloud Baseline Protection
Week 1: Understand and document the Shared Responsibility Model.
Week 2: Conduct a cloud-specific risk analysis.
Month 1: Create a mapping of Baseline Protection building blocks to cloud services.
Month 2: Build a landing zone with Baseline Protection configurations (Policy-as-Code).
Month 3: Centralize logging and monitoring.
Ongoing: Monitor compliance status with cloud tools (e.g., Defender for Cloud).
The Role of BSI C5
BSI C5 and IT Baseline Protection are complementary. BSI C5 is a requirements catalog specifically for cloud services. Many C5 requirements can be met directly with Baseline Protection measures. Anyone implementing IT Baseline Protection in the cloud is well on their way to BSI C5 compliance.
The BSI-compliant cloud security concept should integrate both frameworks. It demonstrates how the requirements of C5 and Baseline Protection are met through technical and organizational measures in the cloud.
Insight42: Your Partner for Cloud Security
We translate IT Baseline Protection for the cloud. We show you how to operate Azure and GCP securely and compliantly. Our IT Baseline Protection consulting is specialized for cloud scenarios.
We build secure landing zones that incorporate ISO 27001 and BSI C5 requirements from the start. With Cloud Managed Services, we ensure ongoing secure operations.
Make your cloud Baseline Protection-compliant. Talk to us.
Figure: Implementing IT Baseline Protection Principles in a Cloud Architecture
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.
