BSI C5:2026 Changes the Rules of Trust in Europe

Published in April 2026, Germany’s Federal Office for Information Security (BSI) has substantially revised cloud attestation requirements to reflect rapidly advancing cloud deployments that increasingly depend on hyperscalers, third-party data processors, application providers, and infrastructure vendors.

The updated C5:2026 attestation provisions require disclosure of information that extends to providers, including data-processing locations, service availability, who in the supply chain can access information, and the jurisdictions in which third-party suppliers are located.

The updated framework considerably expands the attestation criteria from 121 under C5:2020 to 168 criteria spanning 17 subject areas. More importantly, it delivers a much more granular sub-criteria structure intended to make individual requirements, control mappings, and evidence clearer.

Under C5:2020, an individual criterion typically encompasses related cloud security attributes, but C5:2026 decomposes these broader requirements into more precise, independently identifiable expectations.

The result is a subtle but important shift in assurance philosophy. C5:2026 is moving away from simply asking “Do you have a control for this requirement?” toward asking “Can you demonstrate precisely how each element of this requirement is controlled—and provide evidence that the control actually works?” 

Sovereignty is becoming a security requirement

This also points toward a much larger shift underway in Europe. For years, data sovereignty was often discussed primarily as a legal or political concern. Increasingly, it is becoming an architectural and risk-management issue.

Organizations need to understand not only where their primary data resides, but also what additional information their use of a cloud service generates, where that information travels, who controls it, and under what legal regime it may become accessible.

The question is therefore evolving from: “Where is my data?” to: “Who ultimately has power over my data?” That is a substantially harder question for cloud providers—and their customers—to answer.

The supply chain can no longer be a black box

Modern cloud services are rarely delivered by a single organization. Behind one apparently simple SaaS application may sit cloud infrastructure providers, identity platforms, security services, analytics tools, AI models, subprocessors, and numerous other dependencies.

Yet, customers frequently have limited visibility into this ecosystem. C5:2026 strengthens supply-chain requirements, including greater transparency concerning subcontractors and data flows.

For risk leaders, therefore, the relevant question is no longer simply whether a vendor is secure. It is whether the entire service chain is sufficiently transparent, resilient and governable. 

Compliance is becoming machine-readable

One of the least dramatic-sounding C5:2026 changes could ultimately prove among the most transformative. The catalogue is available in machine-readable YAML format. Why should executives care? Because compliance has traditionally been remarkably manual.

Requirements are read from documents. Controls are mapped into spreadsheets. Teams gather evidence through emails and shared drives. Auditors request samples. Teams repeat the exercise months later.

Machine-readable requirements create the foundation for something different: Requirements can potentially be mapped programmatically to control libraries, systems, and evidence.

C5:2026 is part of something bigger

BSI C5 should also not be viewed in isolation.

Its development sits within a much broader European regulatory environment that includes NIS2, DORA, ISO/IEC 27001:2022, and the developing European cloud cybersecurity architecture.

This creates both an opportunity and a burden. Organizations should resist building separate compliance programs for every regulation or framework. Instead, they should develop a common control architecture in which one well-designed control can satisfy multiple obligations. 

The real deadline is not January 2027

BSI's transition framework provides that assessments beginning on or after January 1, 2027, must use C5:2026. That may sound comfortably distant.

It isn't.

Organizations need time to assess gaps, redesign controls, identify evidence, address new technical requirements, remediate weaknesses, and allow controls to operate long enough to demonstrate effectiveness.

This is particularly important for organizations seeking Type 2 assurance, where operating effectiveness must be demonstrated over time.

Waiting until the deadline approaches therefore creates a simple problem: You cannot manufacture historical evidence retrospectively.

Cloud compliance under pressure: Watch the session

Regulators are raising the bar for what trustworthy cloud operations look like. In Europe, the BSI Cloud Computing Compliance Controls Catalogue (BSI C5) has become one of the most rigorous benchmarks for cloud assurance. Watch the session with Andrew Pery (ABBYY) and Liam S. Hurst (SVA GmbH) as they explore why audited controls matter, what to ask technology providers during procurement, vendor due diligence, and outsourcing reviews, plus more.