What is it?
The Cloud Computing Compliance Criteria Catalogue (C5), published by Germany's BSI, defines minimum requirements for cloud-service providers to be considered trustworthy for German customers. It is widely required in regulated sectors (finance, healthcare, public administration) and in tenders run by German federal & state governments.
How it is delivered
C5 is an attestation standard: an accredited auditor performs an examination under ISAE 3000 (or IDW PS 951) and issues a Type 1 (design) or Type 2 (operating effectiveness, typically 6–12 months) report. The report covers both the criteria themselves and the cloud provider's transparency information (data location, subcontractors, investigation requests).
The 17 domains
Organisation of information security, security policies, HR, asset management, physical security, operations, identity & access management, cryptography & key management, communication security, portability & interoperability, procurement / development / change management, control & monitoring of service providers and suppliers, security incident management, business continuity, compliance and data protection, and dealing with investigation requests.
"Basic" and "Additional" criteria
Every domain has basic criteria (the floor) and additional criteria (deeper assurance — used by customers with elevated trust requirements). Many German tenders require additional criteria for specific domains (e.g., cryptography, identity).
Crossovers
C5 maps closely to ISO/IEC 27001 and 27017; a mature ISMS gets you ~70% of the way. The German-specific differentiators are data location transparency, jurisdiction, and government investigation request handling.
How iCompaas helps
iCompaas provides the C5:2020 criteria mapped to evidence sources, a transparency-information template (data centres, subcontractors, response process), and a workflow to compile the auditor's evidence pack at the end of an attestation window.