Type 1
Checks that your controls are designed properly at a single point in time.
Takes a few weeks. A fast way to show German buyers where you stand.
4.9on G2
BSI C5 Audit & Attestation
Prove your cloud security to German buyers with the standard they trust. We take cloud providers from gap assessment to final C5 report.
If that’s ISO certification, penetration tests or any other ongoing services, they are super professional and always helping with a smile.Ori Tzimber, VP R&D, Octopai
A market requirement, not a checkbox.
C5, the Cloud Computing Compliance Criteria Catalogue, is the cloud security standard published by Germany's Federal Office for Information Security (BSI). It brings controls from ISO 27001, ISO 27017 and the Cloud Security Alliance Cloud Controls Matrix into one catalogue built specifically for cloud providers.
German procurement teams ask for it first. Government agencies have required it since 2016, healthcare providers must demand it under the DigiG law, and KRITIS critical infrastructure operators must verify it. We combine cloud security expertise with audit rigor built for the German and DACH market.
Compliance, without the compromises.
- Direct line to your auditorNo ticket queues. Message your audit team directly and get real answers, fast.
- One team, every frameworkSOC 2, ISO 27001, PCI DSS, pen testing: one team, one timeline, no duplicate evidence.
- We work with your stackWe plug into the compliance platforms you already use, adapt to your processes, or bring our own tooling at no extra cost.
- Fixed scope, fixed priceOne clear quote upfront. No change orders, no surprise fees mid-audit.
- Timelines you can plan aroundClear milestones from kickoff to report.
- Always know where you standLive visibility into audit progress, no chasing status updates.
- Built for fast-moving teamsWe understand cloud-native, SaaS and modern DevSecOps, so there is no explaining your stack from scratch.
- Support that does not end at the reportWe stay in your corner after the report: ongoing guidance, not a one-time transaction.
How a C5 engagement runs.
Four phases, one team, and a fixed price agreed before we start.
Assess
- Gap assessmentWe define your audit scope across services, infrastructure and geography, map your controls to C5 and prioritize the gaps. You know exactly what needs to happen and how long it takes.
Remediate
- Remediation and implementationWe guide the missing controls, deploy technical controls as infrastructure-as-code, write policies and run training.
- Evidence reuseExisting ISO 27001 or SOC 2 evidence is mapped to C5, so nothing is done twice.
Prepare
- Evidence and testingReal logs, configurations and training records, organized and mapped to controls. We test controls before the audit, so you know weeks ahead where you stand.
- Audit reviewA final readiness check together before the formal C5 audit.
Attest
- Audit and attestationThe independent auditor reviews design and operating effectiveness, we help you address any findings, and you receive your C5 attestation report.
- Ongoing supportYear-round compliance support, BSI updates tracked and your next audit planned before the current one expires.
Type 1 or Type 2?
Type 2
Checks that your controls worked consistently over a period, usually 3 to 12 months.
What most enterprise customers and procurement teams look for.
Many providers start with Type 1, then move to Type 2. We plan both on the scoping call.
What BSI C5 does for your business.
- DACH market accessUnlock government, healthcare and regulated buyers across Germany, Austria and Switzerland.
- A competitive advantageCloud security credibility German procurement teams recognize, beyond what global standards show on their own.
- Enhanced client trustShow clients and partners your commitment to data security.
- Reduced audit riskAn environment that holds up under scrutiny, with fewer failed audits and lost deals.
Why teams choose GRSee for BSI C5.
GRSee has become a trusted advisor when it comes to all security and compliance issues.Eilon Reshef, CTO & Co-Founder, Gong
- Hands-on C5 executionWe run the audit procedures, coordinate every activity and keep the process moving. The independent C5 auditor issues the final report.
- Built around your cloudAn approach tailored to your infrastructure and your market requirements.
- Support after attestationOngoing guidance to maintain and strengthen your posture year-round.
We felt there’s an owner to the project, who knows from start to finish what to do and how to do it in the most efficient way.Kobi Kochavi, Senior Information Security Manager, Forter
BSI C5 questions, answered.
Still not sure? Bring your questions to a scoping call.
How does C5 differ from ISO 27001?
ISO 27001 is a global information security standard. C5 is cloud-specific, builds on ISO 27001 controls and adds cloud-specific rigor. Providers selling into Germany often hold both.
What is the difference between Type 1 and Type 2?
Type 1 checks that your controls are designed properly at a single point in time. Type 2 checks that they worked consistently over a period, usually 3 to 12 months. Most enterprise customers look for Type 2.
How long does C5 attestation take?
Type 1 takes a few weeks. Type 2 depends on the observation period. Parallel workstreams and a readiness assessment up front cut timelines and avoid rework.
Can we reuse our ISO 27001 or SOC 2 evidence?
Yes. C5, ISO 27001 and SOC 2 overlap heavily. We map your existing evidence to C5 so one control supports several standards.
Can we do C5 and ISO 27001 at the same time?
Yes, and many organizations do. ISO 27001 provides the security foundation and C5 adds cloud-specific requirements. Doing both together is more efficient than one after the other.
Do you test controls after we fix them?
Yes. We validate access controls, encryption, logging and incident response before the formal audit, so you know weeks in advance where you stand.
What happens if we fail the audit?
C5 has no simple pass or fail. The auditor tests your controls and issues a report. If gaps are found, the report may be qualified, disclosing the exceptions. In practice, most companies catch issues during testing and remediate before a report is issued.
Book your scoping call.
Pick a time that suits you. You leave with a scope and a fixed quote.
- A direct line to your auditor
- We work with your stack
- Fixed scope and price
Local teams, your time zone
- United States
- Europe
- Middle East
We work in your time zone and support you in multiple languages.
We met our compliance requirements in less time, with a higher quality result.Jonathan Jaffe, CISO, Lemonade
Booking form not showing?Open it in a new tab