Today, organisations must meet a wide range of requirements relating to information security, cloud security and compliance. These include both statutory requirements and those set by customers and clients.
The Cloud Computing Compliance Criteria Catalogue (C5) published by the Federal Office for Information Security (BSI) is the authoritative standard for cloud security in Germany. It provides transparency regarding the security measures implemented by cloud services and enables their independent auditing and comparability.
A C5 audit demonstrates to your customers, partners and regulatory authorities that:
Our experts assess cloud services and processes against recognised standards and guide you safely through the entire audit and assessment process.
We provide comprehensive support in the preparation, execution and implementation of the audit requirements set out in the C5 criteria catalogue:
Our IT experts will be happy to assist you with all these matters.
Would you like further information or a personal consultation? We’d be happy to arrange a no-obligation appointment with you so that we can get to know each other.
Assessments and audits in the field of information and cyber security require experience. The requirements set out in C5, as well as the assessment of an internal control system, are complex. It therefore makes sense to work with experts who have been carrying out audit and assessment processes for many years and who have an equal understanding of the specific aspects of IT and cyber security, technology, law and data protection.
Our qualified professionals are equally at home in IT, auditing and legal consultancy. This enables us to carry out targeted and properly conducted audits and reviews, and to provide you with information that offers genuine added value.
As part of an audit, legal and tax consultancy firm, IT security is an integral part of our understanding of quality and responsibility. Our specialists bring extensive experience of auditing standards for IT audits in the field of information and cyber security.
We have many years of extensive project experience in all aspects of IT and cyber security. Using best-practice approaches, methods and our expertise, we build on the processes and structures already in place within your organisation.
A C5 audit in accordance with the C5 criteria catalogue is particularly relevant for:
A C5 audit follows a structured approach:
The effort required to prepare for and carry out a C5 audit depends in particular on:
The C5 catalogue (Cloud Computing Compliance Controls Catalogue) published by the BSI is the German audit standard for secure cloud computing. It comprises over 100 criteria covering various subject areas, including organisation, security and cryptography, and is based on established standards such as ISO 27001. The criteria consist of mandatory basic criteria as well as additional criteria, which become relevant depending on the level of protection required.
The result is a C5 audit report, which may only be issued by independent auditors.
A C5 certificate always relates to a specifically defined cloud service within a clearly defined scope. It is not the entire organisation or the entire cloud service provider that is certified, but solely the specific cloud service that has been audited. A separate audit is required for each additional cloud service provided by the same organisation. A separate certificate of compliance is issued for each audited cloud service.
Type I – Assessment of the control system as at a specific date
A Type I audit assesses whether the documented controls are appropriately designed to meet the requirements. The auditor assesses the control environment as at a specific date.
In particular, the following is examined:
Type I therefore assesses the design, but not the actual effectiveness over a longer period. A Type I audit can only be carried out once. A follow-up audit always takes the form of a Type II audit.
Type II – Assessment of adequacy and effectiveness over a period of at least 6 months
A Type II audit goes further and additionally examines whether the controls are adequate and have actually been operated effectively over a defined period of at least six months.
To this end, the auditor also assesses:
Type II is more meaningful because it provides verifiable evidence that controls were not only appropriately designed but were also reliably implemented in day-to-day operations.
The three standards serve different purposes and are aimed at different types of organisations.
C5 Criteria Catalogue (Cloud Computing Compliance Criteria Catalogue)
The C5 Criteria Catalogue is primarily aimed at cloud service providers, particularly in the healthcare sector, where C5 compliance is often a mandatory requirement. It assesses whether cloud security controls have been designed appropriately and, depending on the type, have been operated effectively over a period of time. Cloud customers, particularly in the public sector or in regulated environments such as healthcare, are increasingly demanding proof of C5 certification for a cloud service.
ISAE 3402 / IDW PS 951
ISAE 3402 is an international standard issued by the IAASB and assesses a service provider’s internal control system insofar as it relates to business processes relevant to financial reporting for clients. It is used for outsourcing service providers, for example in data centres, IT operations or HR services. In addition, Germany has IDW PS 951, which similarly audits the compliance of outsourced processes.
SOC 2
SOC 2 is an audit standard that assesses the controls used by service organisations to protect information. SOC 2 reports evaluate how reliably and securely a service is operated in terms of data security, availability, processing integrity, confidentiality and data protection.
With verified IT and compliance evidence, organisations build the trust that is crucial to successful business relationships today. Our experts support you in meeting complex requirements transparently and in designing efficient audit and verification processes. Through clear structures, reliable controls and professional documentation, you not only enhance your security levels but also strengthen your competitiveness. We support you from the initial analysis right through to the final audit report – in a pragmatic, clear and goal-oriented manner. Whether it’s cloud security, internal control systems or Microsoft’s stringent requirements: we ensure your processes are verifiable and audit-ready. In this way, information and cyber security become a genuine source of added value for your business.
Contact form 
+49 228 81000 0