Obligation
Security and availability
C5 expects documented security management, access control, cryptography, monitoring and availability safeguards for cloud services.
BSI C5
The BSI Cloud Computing Compliance Criteria Catalogue (C5) is the German benchmark for cloud security, transparency and auditability — and a common procurement requirement for cloud providers and their customers.
- BSI C5:2020 · cloud provider attestation
- 3 related frameworks
- 4 Wombat pillars
- Last reviewed 31 Oct 2026
Why this matters now.
C5 is structured around auditable criteria: security, availability, confidentiality, integrity, transparency and compliance. Wombat helps teams translate those criteria into concrete architecture checks and reusable evidence.
What the regulation asks for.
A practical reading of the obligations that usually end up in architecture, operations and evidence reviews.
Obligation
Confidentiality and integrity
Data classification, tenant separation, encryption and integrity protection are assessed across the service lifecycle.
Obligation
Transparency and auditability
Providers must make relevant security information available to customers and auditors; evidence has to be traceable.
Obligation
Supply-chain and operations
Incident management, change management, supplier oversight and business continuity are part of the audited control environment.
Where Wombat helps.
Each obligation maps to one or more pillars. The pillar pages show the controls, principles and evidence expectations behind the score.
WAF-SEC
Security
C5's core criteria are security controls: access, cryptography, logging, vulnerability handling and secure configuration.
Read the Security pillar →WAF-SOV
Sovereign
Data residency, jurisdiction, provider dependency and exit paths are central to German cloud procurement.
Read the Sovereign pillar →WAF-OPS
Operational Excellence
C5 is evidence-heavy: change control, incidents, monitoring and supplier oversight need a repeatable operating model.
Read the Operational Excellence pillar →WAF-REL
Reliability
Availability, backup and recovery criteria need to be designed and demonstrated, not assumed.
Read the Reliability pillar →Control themes to review.
These are the control themes teams usually need to evidence. The controls catalogue is the authoritative source for the exact control-level mapping.
Access control and identity
Cryptography and key management
Logging, monitoring and incident management
Supply-chain and provider oversight
Data residency and transparency
Business continuity and availability
STEP 1
Define the service scope and the C5 criteria that apply to the procurement or attestation.
STEP 2
Score the current architecture against the relevant pillars.
STEP 3
Review the C5-tagged control themes and collect evidence per criterion.
STEP 4
Export the evidence package for the auditor, customer or internal risk committee.
Related frameworks and evidence.
Wombat controls carry tags for the frameworks below. Use them to connect the technical baseline to the evidence your auditor or procurement team already expects.
ISO 27001:2022
SOC 2 Type II
GDPR
Prepare a C5 evidence baseline
Use the scorecard to find the gaps, then use the controls catalogue to assemble the evidence before the audit window.
Wombat is a technical framework, not a law firm. These pages map relevant Wombat pillars and control themes to regulatory obligations; they do not provide legal advice. Validate the mapping against the official text and your auditor.
Related compliance hubs.
The same control baseline usually has to satisfy more than one obligation. Jump to the adjacent hub and reuse the evidence.
EU cybersecurity directive
NIS2
NIS2 raises the baseline for cybersecurity risk management, incident reporting and supply-chain accountability across essential and important entities in the EU.
Open the NIS2 hub →EU digital operational resilience
DORA
DORA brings ICT risk management, incident reporting, resilience testing and third-party oversight into one operational-resilience regime for financial entities and their critical providers.
Open the DORA hub →Cloud sovereignty criteria
BSI C3A
C3A is the BSI's non-binding criteria catalogue for digital sovereignty in cloud services. It is structured around six sovereignty categories: strategic, legal and jurisdictional, data, operational, supply chain and technology.
Open the BSI C3A hub →Control, not just location
Sovereignty
Residency, jurisdiction, key ownership, supplier concentration and exit paths — turned into controls a team can assess.
Open the sovereignty hub →