A C5 attestation also carries duties for the customer

The practice software is moving to the cloud. The provider sends a C5 attestation, Type 2, current, with the audit report as a PDF. Purchasing ticks the box, management signs. The audit report contains a chapter nobody has read: the corresponding criteria for customers.

What Section 393 SGB V requires

Section 393 of the German Social Code Book V governs the conditions under which healthcare providers, health and care insurers and their processors may process social and health data by way of cloud computing. Besides the location of processing and appropriate technical and organisational measures, subsection 3 requires that a current C5 attestation of the processing entity covering the C5 basic criteria exists for the cloud systems and technology used, and that the corresponding criteria for customers contained in the audit report have been implemented. In German:

„ein aktuelles C5-Testat der datenverarbeitenden Stelle im Hinblick auf die C5-Basiskriterien für die im Rahmen des Cloud-Computing-Dienstes eingesetzten Cloud-Systeme und die eingesetzte Technik vorliegt und 3. die im Prüfbericht des Testats enthaltenen, korrespondierenden Kriterien für Kunden umgesetzt sind.“

Number 3 is not addressed to the provider. It is addressed to whoever uses the service. The attestation confirms that the provider does its part, on the assumption that the customer does theirs. Which part that is, is in the audit report.

Subsection 4 defines which attestation counts as current: from 1 July 2025, a current C5 Type 2 attestation. A Type 1 report refers to a point in time, a Type 2 report to a period. For systems first placed on the market after 30 June 2025, a Type 1 attestation is still sufficient for the first 18 months.

What corresponding criteria are

Many controls in the cloud only work if both sides play along. The provider offers multi-factor sign-in; the customer has to switch it on for their accounts. The provider logs access; the customer has to review the logs. The provider separates tenants; the customer has to maintain permissions in their own tenant. The C5 explicitly assigns such duties to the customer, and the audit report lists them.

Anyone who has never read this list cannot show that they implement it. And then, under Section 393(3) no. 3, a precondition for using the cloud is missing, even if the provider's attestation is flawless.

What comes from June 2027

The BSI has revised the catalogue as C5:2026. According to the BSI FAQ, the criteria of the C5:2026 are to be applied to all attestations for a specific date (Type 1 reports) or for a period (Type 2 reports) from 1 June 2027. For customers this means the list of corresponding criteria may change with the next audit report. Checking whether you meet them is therefore not a one-off task.

What to do

• Request the audit report, not just the attestation. The corresponding criteria are in the report, not on the certificate.
• Assign the criteria. For each one, a person who implements it in-house and evidence that it is implemented.
• Check the type and period. Type 2, and does the audit period not end so long ago that "current" is questionable?
• Repeat with every new report. At the latest with the switch to the C5:2026.

How isidaten handles this

In the isidaten cloud register, each cloud service shows which evidence exists, including BSI C5. For providers, the BSI C5 module prepares the audit report per service, based on the C5:2026, and outputs the corresponding criteria for customers in the original wording as a list, so they can be passed on with the customer information.

The test question

For your most important cloud service with health data: who in your organisation has read the corresponding criteria in the C5 audit report, and where is it recorded that they are implemented?

If the answer is "we have an attestation", half is missing.

Sources

Section 393 SGB V (German), subsections 1, 3 and 4. BSI, criteria catalogue C5, FAQ (German, retrieved on 26.10.2026). More on the difference between attestation and certificate in the Basic terms series: An attestation is not a certificate.