What is C5?
C5 (Cloud Computing Compliance Criteria Catalogue) is the cloud security standard of Germany’s Federal Office for Information Security (BSI), first published in 2016 and updated in April 2026. Cloud and SaaS providers receive an independent audit report, an attestation rather than a certificate. It goes beyond ISO 27001 with cloud-specific controls such as multi-tenancy and subprocessors, and requires transparency on data location and government access. It is increasingly the expected standard for German public sector, finance, healthcare and critical infrastructure (KRITIS) buyers.
Who needs it
- Cloud and SaaS providers selling into Germany
- DACH companies in fintech, insurtech, healthtech and pharma
- Critical infrastructure (KRITIS) operators and their suppliers
What usually triggers it
- A German enterprise or public buyer asks for a C5 attestation
- ISO 27001 alone is not enough to close a regulated German deal
How the process works
- Gap assessment against the C5 criteria
- Close gaps, often building on an existing ISO 27001 program
- Independent audit and attestation
How Holam helps
We work out whether C5 is what your customers actually need, and in what order alongside other frameworks. We then introduce you to a compliance platform and specialists that fit your stage, and stay involved until the result is in your hands. Holam receives a referral fee from providers we introduce when you engage them. You pay the provider directly, we add nothing to their price, and you remain free to choose another provider.
Frequently asked questions
Do we need ISO 27001 first?
Not formally, but an ISO 27001 program covers much of the groundwork.