BSI C5 · Cloud Computing Compliance Criteria · Evidence & Implementation Kit
Achieve a BSI C5 attestation for your cloud service, without mapping the criteria catalogue to evidence yourself.
Every C5 control domain handed to you as an adopt-ready control, from identity and cryptography through subservice monitoring to the distinctive government-request transparency, with the evidence an auditor examines under ISAE 3000.
Attestation-ready in a weekend, not a quarter.
Here is the honest situation. German and European customers increasingly require a BSI C5 attestation before trusting a cloud service, and C5 is audited under ISAE 3000, as a Type 1 design attestation or a Type 2 operating-effectiveness one. It spans control domains from organisation and identity to cryptography, operations, business continuity and, distinctively, transparency about how you handle government investigation requests and your jurisdiction. Building all of that and the evidence, and passing the audit, is weeks of work, and a control with no operating evidence or a missing jurisdiction disclosure is exactly where the attestation qualifies.
This Kit removes that build. It is every C5 control domain written as an adopt-ready control you personalize in a weekend, with the evidence an auditor examines.
What you get, the moment you buy
36
Criteria as adopt-ready controls. Every C5 control domain, from organisation and identity through cryptography, operations, business continuity, subservice monitoring and government-request transparency, written so you personalize and apply it.
36
Evidence-they-examine checklists. For each control, exactly what an auditor examines, plus where the attestation qualifies, so you close the gap before the audit.
1
C5 Control Matrix, pre-built. Every criterion in a working spreadsheet, ready to record design and operating-effectiveness evidence location across the cloud service.
1
Gap & Readiness Assessment. Score each criterion and the workbook returns your attestation readiness as a single percentage, and exactly what to fix next.
Grounded in the BSI C5 (Cloud Computing Compliance Criteria Catalogue), audited under ISAE 3000, with the identity, cryptography, subservice-monitoring and government-investigation-request transparency domains called out. Editable Word and Excel files.
Government-request transparency is what makes C5 distinctive
Unlike most cloud frameworks, C5 requires you to disclose how you handle government investigation requests, your data location and your jurisdiction. This Kit builds that transparency domain, so the distinctive C5 disclosures European customers care about are handled, not overlooked.
What one control looks like
This is handling government investigation requests, a distinctive C5 transparency domain. All 36 are built to this depth.
DLL-01 Handling of government investigation and disclosure requests TRANSPARENCY
Implement this control
[Cloud Service Provider] shall operate a documented process for receiving, legally reviewing, and responding to government and law enforcement requests for customer data, disclose only what is legally required, involve legal counsel before any disclosure, record each request and the response, and where legally permitted notify the affected customer.
Attestation note.
This distinctive C5 domain gives customers assurance about how state access requests are governed and constrained.
Evidence an auditor examines
- Government request handling procedure with legal review steps
- Register of received requests and documented responses
- Legal counsel involvement records for disclosures
- Customer notification records where legally permitted
Common finding they raise: Requests are handled ad hoc by operations staff without mandatory legal review or a request register.
Why this is not another template pack
- The evidence is the point. A control with no operating evidence qualifies the attestation. This tells you what an auditor examines and where the attestation qualifies, for every domain.
- Type 1 and Type 2 built in. The design and operating-effectiveness distinction is written into the controls, so you can prepare for the C5 attestation type your customers require.
- Built on a mapped compliance corpus, not one person's opinion, from a graph of thousands of controls across standards.
- It compounds. C5 aligns with ISO 27001 and SOC 2, so this work maps onto those attestations and your wider cloud security program.
Who buys this
Cloud service providers serving German and European customers, the security and compliance leads who own the attestation, and consultants preparing for a C5 audit. Whether it is a first attestation or a renewal, you save weeks and walk in with the criteria and evidence ready.
By the end of the weekend you will have
✓ An adopt-ready control for all 36 criteria
✓ A completed C5 control matrix
✓ The evidence an auditor examines
✓ Your identity, cryptography and transparency domains anchored
✓ A readiness percentage and a fix list
✓ The qualifications designed out
Common questions
Is it really editable? Yes. Word and Excel files you own and adapt. No portal, no subscription.
How is C5 audited? Under ISAE 3000, as a Type 1 design attestation or a Type 2 operating-effectiveness attestation. The Kit prepares you for both.
Does it cover government-request transparency? Yes. The distinctive domain requiring disclosure of how you handle government investigation requests and your jurisdiction is built as controls.
How does it relate to ISO 27001? C5 aligns with ISO 27001 and SOC 2, so the controls and evidence carry across.
What if it is not for me? A 30-day money-back guarantee.
Do not go into a C5 audit with controls but no evidence.
Every C5 criterion is fast to adopt with the Kit. It is instant, and it is guaranteed.
Add it to your cart and be attestation-ready this weekend.
Instant digital download · 30-day money-back guarantee · The Art of Service Pty Ltd, GPO Box 2673, Brisbane QLD 4001 · support@theartofservice.com
