What the BSI C5 Copilot Can Do
C5:2020 criteria mapping and gap analysis
Type 2 as the de facto procurement baseline, and when Type 1 suffices
Environment parameter documentation support
System description and control evidence templates
Cross-mapping to ISO 27001, ISO 27017, and SOC 2
Transition planning from C5:2020 to the C5:2026 catalogue
About BSI C5 Copilot
BSI C5 is the German Federal Office for Information Security's Cloud Computing Compliance Criteria Catalogue. In practice a Type 2 attestation has become the baseline for cloud services in German public sector and regulated procurement. The BSI C5 Copilot helps cloud service providers prepare attestation readiness against the current C5:2020 criteria and plan for the published C5:2026 successor.
Cross-framework mappings
Working across BSI C5 and another standard? ISMS Mappings is a free public directory of control maps (ISO 27001, SOC 2, NIST, GDPR, and more). A Better ISMS tool, separate from the chat assistant.
Browse free mappingsFrequently Asked Questions
What is BSI C5?
BSI C5 (Cloud Computing Compliance Criteria Catalogue) is the German government's cloud security standard. C5 attestation is increasingly required for cloud providers serving German federal agencies and regulated industries.
Is C5 mandatory?
Not by statute for providers in general. It reaches you through procurement: federal cloud tenders commonly require C5 attestation or use it as the baseline, with Type 2 as the de facto standard, and healthcare (DiGAV), KRITIS, and regulated buyers follow the same expectation. BSI notes an attestation alone is not sufficient, and a missing attestation can sometimes still be obtained during procurement.
How does it relate to SOC 2?
C5 attestation follows a SOC 2-style audit approach (Type 1/Type 2) but incorporates additional requirements from ISO 27017, BSI IT-Grundschutz, and the CSA Cloud Controls Matrix.
Ready to do compliance work faster?
Built for speed, accuracy, and audit-ready output.