C5 Field Guideunofficial

About this site

What this is

An unofficial guide to the BSI C5:2026 Cloud Computing Compliance Criteria Catalogue. Every criterion has its own page with a stable address, for example /en/iam-06/, and every sub-criterion its own anchor, for example /en/iam-06/#iam-06-02b, so you can paste it into a design review or a chat thread.

Two kinds of content, kept apart

  • BSI text: criterion text, supplementary information, complementary customer criteria and General Conditions. Reproduced unchanged from BSI's machine-readable edition; only formatting (paragraphs, numbered lists) and cross-reference links are added.
  • Commentary (coming later, marked in blue as unofficial): our own reading in engineering terms. It is not BSI guidance and not legal or audit advice.

Licence and source

C5:2026 © Federal Office for Information Security (BSI) 2026, licensed under CC BY-ND 4.0. Source: BSI C5:2026.

The German edition (v1.1.0) contains corrections that the English edition (v1.0.1) does not have yet, so the two languages can differ in details. For example, the sub-criteria of AM-01 and AM-02 are numbered differently, so a link to a specific sub-criterion may point to different text after switching language. German is this site's primary language.

The changes since C5:2020 come from BSI's C5:2026 Changelog, also licensed under CC BY-ND 4.0. According to BSI, it compares C5:2020 with version 1.0.0 of C5:2026, so corrections made after that version are not described there.

This site adds only presentation to BSI's text: paragraphs, numbered lists and cross-reference links.

This site is not affiliated with or endorsed by BSI.

Keyboard

  • / or Ctrl/⌘ K: search; ↑ ↓ and Enter to open a result, Esc to close.
  • ↑ ↓ move through the domain and criteria lists.

Contributing

  • Commentary: commentary/en/<ID>.md (German: commentary/de/), for example commentary/en/IAM-06.md
  • BSI source data: vendor/bsi/. Never edited by hand; updated by importing a new BSI release.