BSI C5 · who asks for it
Health and social data may only go into a cloud service that holds a current C5 attestation.
Type 2 since 1 July 2025. No C5, no contract.
C5 comes from the BSI, the same authority that sets security rules for the federal administration.
It can name specific additional criteria, and it decides the first cut.
One report replaces the buyer's own security review: the long questionnaire, the calls, sometimes their own audit.
ISO 27001 plus SOC 2 can start the deal if you name a date for C5.