# C5 Field Guide (English)

> Unofficial, navigable edition of BSI's C5:2026 Cloud Computing Compliance Criteria Catalogue. The criterion text is BSI's, reproduced unchanged under CC BY-ND 4.0; English edition v1.0.1.

Deutsche Fassung (primary edition, includes later corrections): [https://c5.patrickscheid.de/llms.txt](https://c5.patrickscheid.de/llms.txt)

Notes on the catalogue:

- C5:2026 has 168 criteria in 17 domains and 6 General Conditions (GC). A criterion such as IAM-06 consists of sub-criteria such as IAM-06.02B. The suffix gives the kind: B = basic criterion, AS = additional criterion that sharpens a basic one, AC = additional criterion that complements.
- Every criterion page is available as Markdown at its address plus `index.html.md`, e.g. `https://c5.patrickscheid.de/en/iam-06/index.html.md`. The Markdown also contains BSI's supplementary information, the complementary customer criteria and what changed since C5:2020.
- Many criteria had a different ID in C5:2020 (e.g. IDM-06, now IAM-06). The domain overviews and the changes overview give the former ID.
- This site is not affiliated with BSI. BSI's catalogue is authoritative: https://www.bsi.bund.de/EN/Themen/Unternehmen-und-Organisationen/Informationen-und-Empfehlungen/Empfehlungen-nach-Angriffszielen/Cloud-Computing/Kriterienkatalog-C5/C5_2025/C5_2025_node.html

## Domains

- [OIS – Organisation of Information Security](https://c5.patrickscheid.de/en/ois/index.html.md): 10 criteria
- [SP – Security Policies and Procedures](https://c5.patrickscheid.de/en/sp/index.html.md): 3 criteria
- [HR – Personnel](https://c5.patrickscheid.de/en/hr/index.html.md): 8 criteria
- [AM – Asset Management](https://c5.patrickscheid.de/en/am/index.html.md): 12 criteria
- [PS – Physical Security](https://c5.patrickscheid.de/en/ps/index.html.md): 8 criteria
- [OPS – Operations](https://c5.patrickscheid.de/en/ops/index.html.md): 35 criteria
- [IAM – Identity and Access Management](https://c5.patrickscheid.de/en/iam/index.html.md): 9 criteria
- [CRY – Cryptography and Key Management](https://c5.patrickscheid.de/en/cry/index.html.md): 19 criteria
- [COS – Communication Security](https://c5.patrickscheid.de/en/cos/index.html.md): 8 criteria
- [PI – Portability and Interoperability](https://c5.patrickscheid.de/en/pi/index.html.md): 3 criteria
- [DEV – Procurement, Development and Modification of Information Systems](https://c5.patrickscheid.de/en/dev/index.html.md): 15 criteria
- [SSO – Control and Monitoring of Service Providers and Suppliers](https://c5.patrickscheid.de/en/sso/index.html.md): 8 criteria
- [SIM – Security Incident Management](https://c5.patrickscheid.de/en/sim/index.html.md): 6 criteria
- [BCM – Business Continuity Management](https://c5.patrickscheid.de/en/bcm/index.html.md): 4 criteria
- [COM – Compliance](https://c5.patrickscheid.de/en/com/index.html.md): 4 criteria
- [INQ – Dealing with Investigation Requests from Government Agencies](https://c5.patrickscheid.de/en/inq/index.html.md): 4 criteria
- [PSS – Product Safety and Security](https://c5.patrickscheid.de/en/pss/index.html.md): 12 criteria
- [GC – General Conditions](https://c5.patrickscheid.de/en/gc/index.html.md): 6 disclosures in the system description

## Across all domains

- [Changes since C5:2020](https://c5.patrickscheid.de/en/changes/index.html.md): status of every criterion (new, changed, unchanged) with its former ID
- [Complementary customer criteria](https://c5.patrickscheid.de/en/customer-criteria/index.html.md): what cloud service customers implement themselves, collected from all criteria

## Optional

- [Complete catalogue](https://c5.patrickscheid.de/en/llms-full.txt): all criteria, supplementary information, customer criteria and General Conditions in one file (about 0.5 MB)