Are your customers evaluating cloud services according to BSI requirements and requesting C5 certification?
Then you need an audit that fully maps to the BSI criteria catalog – and stands up to the critical scrutiny of your customers' information security, compliance, and procurement departments.
Certinova guides you efficiently through the entire process: from the initial readiness assessment and the definition of scope and audit areas, to the attested Type 2 report based on the current C5 criteria catalog.
Our auditors combine technical expertise with a digital platform that noticeably reduces the internal workload for your organization.
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
Regardless of where you are starting from, we provide the right service for your current level of maturity – without detours and without overhead.
We assess your cloud controls against the BSI's current C5 criteria catalog, uncover gaps, and prioritize measures. You start with a realistic picture and an actionable roadmap.
Type 1 certifies that your controls are appropriately designed as of the audit date. It is the ideal starting point for meeting initial customer requirements. Type 1 confirms that your controls are appropriately designed as of the audit date.
Type 2 confirms that your controls are operating effectively over a defined period—the report that demanding customers in government, financial services, and regulated industries expect for their approval processes.
C5 can be effectively combined with SOC 2, ISO 27001 readiness, or TISAX. We map controls once, audit once, and provide multiple proofs—for significantly less effort.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From the distinction between C5 and SOC 2 to choosing between Type 1 and Type 2, and ensuring customer acceptance—here you will find the answers to the most frequently asked questions during scoping meetings.
Is your question not listed? Please contact us directly.
Both standards address the security of cloud services but differ in their origin and market focus. BSI C5 was developed by the German Federal Office for Information Security (BSI) and is the established standard for cloud providers in German-speaking countries—especially for public sector clients, financial service providers, and regulated industries. SOC 2 is the internationally recognized standard from the AICPA and is primarily expected by enterprise customers in the Anglo-American sphere. Many cloud providers require both certifications in parallel. We will clarify which variant—or combination—is right for you during scoping, based on your customer requirements.
A Type 1 report confirms that your controls are appropriately designed as of a specific date. A Type 2 report goes further, additionally assessing whether these controls have functioned effectively over an audit period, typically six to twelve months. Type 1 is suitable as a starting point or if you need certification on short notice. However, demanding customers, especially in government and regulated industries, generally require a Type 2 report as reliable evidence.
Yes. If you already hold ISO 27001, SOC 2, TISAX, or comparable certifications, we map your existing controls to the requirements of the C5 criteria catalog. Previously documented policies, risk analyses, and technical measures are incorporated into the audit, so you don't have to collect them twice. This significantly reduces internal effort and shortens preparation time. During the scoping meeting, we will identify together which existing evidence can be used and where additional work is actually required.
C5 reports follow the mandatory requirements of the BSI criteria catalog and are the established standard for cloud security certification in the German market—particularly for public sector clients and regulated industries. Crucial to their acceptance are a well-chosen scope, full coverage of relevant criteria, and a sufficiently long audit period for Type 2 reports. We coordinate these points with you at the outset—ideally incorporating the expectations of your key customers—to ensure the report reaches its intended destination: your customers' trust centers and approval processes.
Let's get in touch to discuss your requirements.
