Compliance Without the Merry-Go-Round: BSI C5:2026, NIST, and CCM — What German Public-Sector Buyers Now Expect
🇩🇪 Auf Deutsch lesen~7 min read
TechnologyPublic SectorSecuritybsi-c5nist-csfcsa-ccmcompliancepublic-sectornis2
At the end of March 2026, Germany's BSI quietly published C5:2026 — the first complete revision of its Cloud Computing Compliance Criteria Catalogue since 2020. Hardly anyone talked about it, yet it contains a hard deadline: for audit periods ending on or after 1 June 2027, the BSI recommends the new version. If you sell cloud services to German companies or the public sector, your next attestation already runs on C5:2026.
That would be a footnote in procurement law if C5 were not the backbone of cloud security purchasing in Germany. The BSI has counted more than a hundred attestations — from German mid-market providers to global hyperscalers. Anyone offering cloud or AI infrastructure to public buyers today cannot get around three catalogues: NIST CSF 2.0, CSA CCM, and C5:2026. The good news: they are deliberately aligned with each other. Once you understand the mapping, you stop doing the work twice.
The three frameworks NIST CSF 2.0, ISO 27001, and CSA CCM feed the C5:2026 shield; the stamp marks the audit-period deadline of 1 June 2027
Three Catalogues, One Goal
| Framework | Steward | Version | Size | Role |
|---|---|---|---|---|
| NIST CSF 2.0 | NIST (US) | Feb 2024 | 6 functions, 106 subcategories | International risk vocabulary |
| ISO/IEC 27001:2022 | ISO/IEC | 2022 | 93 controls in 4 themes | Certifiable ISMS |
| CIS Controls v8.1 | CIS | May 2024 | 18 controls, 153 safeguards | Technical hardening |
| CSA CCM v4 | Cloud Security Alliance | Jan 2021 | 197 controls in 17 domains | Cloud role model |
| BSI C5:2026 | BSI (Germany) | Mar 2026 | Successor to C5:2020 | Attestation for the German market |
The NIST Cybersecurity Framework is the most neutral common denominator: voluntary, free, and since version 2.0 explicitly designed for organisations of every size. Its six functions — Govern, Identify, Protect, Detect, Respond, Recover — with Govern as the new roof have become the lingua franca of security management. Even if you never deal with US agencies: when a customer asks how your security programme is structured, a CSF answer is the one understood everywhere.
The CSA Cloud Controls Matrix solves the problem every other catalogue sidesteps: who implements which control — the provider or the customer? 197 control objectives across 17 domains, each with role assignments. Add the CAIQ questionnaire: providers answer standardised, customers read — instead of running every client's bespoke security questionnaire merry-go-round.
C5:2026 — What Actually Changed
C5 is not a law but an audit catalogue with market weight. The model: the cloud provider commissions an auditor directly, the auditor attests compliance with the criteria, and the customer evaluates the report for their own risk management (the BSI itself audits nobody and does not evaluate reports either). For buyers, the attestation is the key pre-filter in provider selection — and for providers, the evidence the German market expects.
The 2026 revision has three essential threads:
- EUCS compatibility from birth. C5:2020 was the basis for the security requirements of the European certification scheme EUCS Level "Substantial"; those requirements went to CEN/CENELEC and were developed into a Technical Specification there. Exactly that material now underpins C5:2026. The German attestation and the European scheme share their DNA.
- Current references. The current versions of CSA CCM v4, ISO/IEC 27001:2022, and the NIS2 directive were considered during drafting — plus practical experience from providers, auditors, and consultants.
- A fixed switch. C5:2020 remains recommended for audit periods ending before 1 June 2027; after that, C5:2026. If you plan an attestation inside that window, you start the delta analysis now, not next year.
Practical bonus: the BSI publishes a cross-reference table from C5 to ISO 27001:2022. If you already run an ISMS, you can reuse evidence instead of documenting everything twice.
What the Public Sector Adds
For public administration, the frame is bigger than C5 alone:
- NIS2 and the BSIG. EU directive 2022/2555 had to be transposed by October 2024; Germany's implementation (the NIS2UmsuCG) slipped past the deadline, but it brings expanded reporting and due-diligence duties for "highly critical" and "critical" entities — and depending on the final text, public administrative bodies fall inside its scope too. Their contractors inherit the documentation duties through the contracts.
- IT-Grundschutz. The BSI's standard corpus (BSI Standards 200-X) remains the reference methodology for German authorities. C5 covers the cloud view, Grundschutz the whole organisation — the catalogues complement each other; they do not compete.
- Digital sovereignty. Projects like openDesk and the EUCS discussion point in one direction: European administrations want evidence that does not depend on a single US institute. That is precisely why the C5→EUCS line matters — it makes German attestations pluggable into the European scheme.
- AI Act, Article 4. Since February 2025 the AI-literacy duty applies to all providers and deployers of AI systems — public authorities as deployers expressly included. If you run a RAG system or a copilot for an administration, you deliver two kinds of evidence at once: technical hardening (the C5/CCM world) and AI governance (flanked in Germany by the BSI's AIC4, internationally by ISO 42001 and the NIST AI RMF).
What This Means for Vendors
If you deliver cloud or AI services to German companies or authorities:
- Demand C5 attestations from your own supply chain. You are a customer of your cloud and hosting providers — their attestations belong in your risk file. The BSI's evaluation guide (an Excel workbook) gives that a structure.
- Build on CIS Controls v8.1 as the technical baseline (IG1 first), structure the programme in NIST CSF profiles — Current versus Target — and you automatically speak the language auditors and buyers expect.
- An attestation only when someone demands it. ISO 27001 or C5 are contract and market-entry topics, not ends in themselves. The evidence from steps 1 and 2 feeds both when the time comes.
- Think AI controls along with it. The CSA published exactly that control layer on top of CCM with the AI Controls Matrix (AICM v1.1), mapped to ISO 42001, NIST AI RMF 1.0, and BSI AIC4 — currently the most direct way to cover model governance and inference security without building your own.
The Clock
| Date | Event |
|---|---|
| 17 Oct 2024 | NIS2 transposition deadline (DE implementation delayed) |
| 17 Jan 2025 | DORA applies to financial entities |
| 2 Feb 2025 | EU AI Act Art. 4 — AI literacy, all providers and deployers |
| 2 Aug 2025 | AI Act obligations for general-purpose AI models |
| End Mar 2026 | BSI C5:2026 published |
| 2 Aug 2026 | AI Act high-risk obligations (Annex III) |
| 1 Jun 2027 | C5:2026 for audit periods ending from this date |
The trend across every catalogue is the same: they map onto each other, and evidence produced once travels. If you build a mapping table of your own controls and evidence today — in essence a bipartite graph between controls and frameworks — you have saved yourself half of tomorrow's audit effort.
Concretely: pull the catalogue and cross-reference table from the BSI C5 page, download the CSA's CCM v4, and sketch your Current position against NIST CSF 2.0. Three downloads, one afternoon — and the next questionnaire from a public buyer stops being a fire drill.