C5 Type 1 vs. Type 2: Design vs. Operating Effectiveness — What's the Difference?

Understanding the difference is important when planning your compliance strategy, especially if you're serving German government agencies, healthcare organizations, or other regulated industries.

By Tom Rozen

Published August 26, 2026

Organizations preparing for C5 attestation often face an important question: Should we pursue Type 1 or Type 2?

Both attestations evaluate cloud security controls against Germany's Cloud Computing Compliance Criteria Catalogue (C5), but they provide different levels of assurance. Type 1 focuses on whether controls have been properly designed, while Type 2 evaluates whether those controls continue to operate effectively over time.

» Preparing for C5 attestation? Contact us to assess your current controls, identify gaps, prepare your evidence, and build a clear path toward attestation.

C5 Type 1: A Point-in-Time Assessment

C5 Type 1 attestation evaluates whether an organization's security controls are properly designed and implemented at a specific point in time.

Unlike C5 Type 2, it provides a snapshot of the organization's cloud security posture rather than evaluating whether controls operate effectively over an extended period.

The C5 Type 1 assessment reviews whether required policies, procedures, and technical controls are in place and aligned with applicable C5 requirements. It demonstrates that an organization has established an appropriate security framework, but it does not evaluate how consistently those controls operate after the assessment.

What Does a C5 Type 1 Assessment Evaluate?

A C5 Type 1 assessment focuses primarily on whether required controls have been:

Designed appropriately to address relevant security requirements
Implemented within the organization's cloud environment
Supported by documented policies and procedures
Aligned with applicable C5 requirements

Because the assessment focuses on control design and implementation rather than long-term operating effectiveness, C5 Type 1 attestation is generally faster and less costly to achieve than Type 2.

Many organizations complete preparation and the assessment process within three to four months, depending on the maturity of their existing security program and the scope of the environment.

For organizations beginning their C5 compliance journey, Type 1 can serve as a practical starting point before transitioning to C5 Type 2 and demonstrating ongoing operational effectiveness.

C5 Type 2: Demonstrating Operational Effectiveness

C5 Type 2 attestation evaluates whether security controls operate effectively over an extended period, not just whether they are properly designed and implemented.

The assessment typically covers an observation period of six to twelve months in a live production environment.

During the observation period, auditors review evidence showing that C5 security controls continue to operate as intended. This may include:

Access reviews and user permission records
Security monitoring and logging activities
Incident response records
Change management documentation
Other operational evidence demonstrating ongoing control effectiveness

This makes C5 Type 2 compliance a stronger form of assurance than a point-in-time assessment. It demonstrates that security controls are embedded in an organization's day-to-day operations rather than implemented only to prepare for an audit.

C5 Type 2 Audit Timeline

After the observation period is complete, the formal C5 Type 2 audit typically takes four to six months, depending on the scope and complexity of the cloud environment.

Overall, organizations should plan for both the observation period and the formal audit when preparing for C5 Type 2 attestation. Starting early allows teams to establish consistent evidence collection and address control gaps before the formal assessment begins.

Why C5 Type 2 Attestation Matters

C5 Type 2 attestation is increasingly important for organizations that need to demonstrate ongoing operational effectiveness of their security controls.

Unlike C5 Type 1, which provides a point-in-time assessment, Type 2 demonstrates that security controls continue to operate effectively over an extended period.

In Germany's healthcare sector, many affected cloud providers were expected to obtain C5 Type 2 attestation by July 2025 under updated healthcare requirements. Government agencies and other regulated industries are also placing greater emphasis on operational effectiveness when evaluating cloud service providers.

Why Organizations Prefer C5 Type 2

Enterprise procurement teams increasingly prefer C5 Type 2 compliance because it provides evidence that security controls continue to operate as intended rather than existing only during a single assessment.

For organizations that handle sensitive data or support critical services, C5 Type 2 provides stronger assurance to:

Customers evaluating cloud service providers
Regulators assessing security and compliance
Business partners conducting vendor risk reviews
Enterprise procurement teams evaluating security assurance

By demonstrating sustained control effectiveness, C5 Type 2 attestation can strengthen customer confidence and help cloud providers meet the security expectations of regulated and enterprise markets.

» Not sure whether C5 applies to your organization? Get expert guidance to assess your requirements, identify security gaps, and prepare for C5 attestation.

Key Differences Between C5 Type 1 and Type 2

Although C5 Type 1 and C5 Type 2 attestations follow the same C5 framework, they differ in assessment timeline, scope, level of assurance, and overall effort.

Factor	C5 Type 1	C5 Type 2
Assessment timeline	Often completed within three to four months	Requires a six- to twelve-month observation period, followed by an audit that typically takes another four to six months
Assessment scope	Evaluates the design and implementation of security controls at a specific point in time	Evaluates both control design and operational effectiveness over time
Cost and effort	Generally requires less time, evidence collection, and investment	Requires greater time, ongoing evidence collection, and audit effort
Customer acceptance	Often viewed as an initial C5 compliance milestone	Increasingly preferred by enterprise customers and regulated industries

C5 Type 1 vs. Type 2: Which Requires More Effort?

C5 Type 2 generally requires more time and effort than Type 1 because organizations must demonstrate that security controls operate effectively throughout an extended observation period. This requires consistent evidence collection, ongoing control monitoring, and additional audit procedures.

C5 Type 1 can be a practical starting point for organizations beginning their C5 compliance journey, while C5 Type 2 provides a higher level of assurance for customers, regulators, and business partners that security controls remain effective over time.

Which C5 Attestation Should You Choose?

The right C5 attestation depends on your business objectives, customer requirements, industry, and target market. While C5 Type 1 can provide an initial assessment of security control design and implementation, C5 Type 2 provides stronger assurance through an evaluation of ongoing operational effectiveness.

Organizations beginning their C5 compliance journey may start with C5 Type 1 to establish the required security controls and demonstrate initial readiness.

Organizations pursuing German government contracts, supporting healthcare providers, or operating in other regulated sectors should generally plan for C5 Type 2 attestation. Enterprise customers may also prefer Type 2 because it demonstrates that security controls continue to operate effectively over time.

A Practical Path to C5 Type 2

For many organizations, a practical approach is to begin with C5 Type 1 while developing the operational processes, monitoring activities, and evidence collection needed for Type 2.

This approach creates a structured path from initial C5 readiness to C5 Type 2 compliance, while helping organizations prepare for future customer, regulatory, and business requirements.

» Strengthen your C5 readiness with expert assessments designed to identify security gaps and prepare your organization for attestation.

How GRSee Consulting Can Help

Preparing for C5 Type 1 or Type 2 requires more than implementing security controls. Organizations must understand the evidence auditors expect, establish repeatable operational processes, and ensure those controls continue to perform consistently over time.

GRSee Consulting helps organizations prepare for both C5 attestation types by conducting readiness assessments, identifying compliance gaps, strengthening security controls, and developing the documentation and operational evidence needed for successful audits. We also help organizations align C5 with existing initiatives such as ISO 27001 and SOC 2 to reduce duplicated effort and accelerate compliance.

» Whether you're preparing for your first C5 assessment or planning your transition to Type 2, GRSee team can help you build a practical roadmap that supports both compliance and long-term business growth.