German cloud assurance
Prepare cloud services for C5 attestation.
Germany’s BSI C5 catalogue sets criteria for assessing cloud service security. We help cloud providers scope the service, operate controls, document responsibilities, and prepare evidence for an independent C5 examination.
Our implementation focus
Make the requirements operational.
- 01
Identify services and systems in the C5 boundary
- 02
Map C5 criteria to existing cloud controls
- 03
Document customer and provider responsibilities
- 04
Operate and evidence security controls
- 05
Prepare the service description and assessor handoff
C5 is an attestation based on independent examination, not a BSI-issued certification. Normstone does not perform the independent examination.
Questions we hear
Get the distinctions right.
Is C5 a certification issued by the BSI?
No. The BSI publishes the criteria. Independent examiners conduct C5 attestations; the BSI says it does not issue a C5 certification.
Can an ISO/IEC 27001 certificate replace a C5 report?
No. Controls and evidence may overlap, but the standards, service boundaries, and assurance outputs differ.
Work with Normstone
Build a defensible path to readiness.
Tell us the outcome you need and the markets involved. We’ll help define the work.