Cloud Computing Compliance Criteria Catalogue

Cloud providers promise a lot of security. C5, short for Cloud Computing Compliance Criteria Catalogue, makes those promises testable. It is published by the German Federal Office for Information Security (BSI).

#How the catalogue is structured

The catalogue is organised into domains: organisation of information security, personnel, identity and access management, cryptography, operations, incident management, business continuity and more. It separates basic criteria from additional criteria for higher requirements.

It also asks for transparency information: where is data processed, under which jurisdiction, with which further evidence? This helps customers assess risks such as data location and access by authorities themselves.

#Type 1 and Type 2 attestations

Audits are carried out by auditors under recognised assurance standards. The result is an attestation, not a certificate. The difference is subtle but matters in tenders: what is assessed is the audit report, not a seal.

An attestation looks back at a date or a past period. Audits are therefore repeated regularly so that the evidence stays current. Always ask for the date of the latest report.

#Where C5 is required

Public buyers and regulated industries often name C5 as a requirement. In German healthcare, section 393 of Social Code Book V ties the processing of health and social data in the cloud to a current C5 attestation.

Add-ons

Semantic²Univerx Channel

Platform

Contact CenterAIWorkforceJourneysOutboundMarketplace & DeveloperServices

Univerx Cloud

Europe layer

GDPREU data residencyEU AI ActBSI C5eIDASNIS2DORABFSG / EAA

#Reading an attestation

#Designed for, not attested

More in the Trust Center under BSI C5 and Security & availability. How security is built into a move to the cloud is covered in the guide Cloud migration from your existing system.