This C5 2026 transition pack is the documented control environment a cloud service provider needs for BSI C5:2026, the revision published in April 2026 that replaces C5:2020. 107 editable Word policies mapped to the eighteen domains of the catalogue, downloadable the moment you check out. On this page:
- What is in the toolkit
- What the C5 2026 transition actually requires
- Who needs C5 2026 transition
- How the documents map to the framework
- Frequently asked questions
- Related toolkits
What is in the C5 2026 transition pack
Documents are filed by C5 domain, using the catalogue own two and three letter domain codes so an auditor can follow the mapping without a crosswalk. The domains covered:
- OIS Organisation of Information Security, and SP Security Policies and Work Instructions
- HR Human Resources, AM Asset Management, PS Physical Security
- OPS Operations, IDM Identity and Access Management, CRY Cryptography and Key Management
- COS Communication Security, PI Portability and Interoperability
- PSC Procurement and Supply Chain, SIM Security Incident Management
- BCM Business Continuity Management, COM Compliance
- INQ Managing Investigative Requests, PSS Product Safety and Security, DEV Development
- Cross-domain documents that sit above the individual domains, including the shared responsibility matrix and the attestation readiness material
What the C5 2026 transition actually requires
BSI published C5:2026 in April 2026 as the successor to C5:2020. The revision is structural, not cosmetic: criteria now carry distinct subcriteria, the catalogue is published in machine-readable YAML alongside the usual PDF and Excel, and the content pulls in requirements from the EU cybersecurity certification scheme, ISO/IEC 27001:2022 and NIS2.
The dates matter. A Type 1 attestation must meet C5:2026 from 1 June 2027, and Type 2 assessment periods beginning on or after that date must use the new catalogue. Crucially, you cannot mix criteria sets – an attestation is against C5:2020 or against C5:2026, not a blend of the two. That makes the C5 2026 transition a clean cutover you have to plan, rather than a gradual drift.
New subject matter in this revision includes container management, supply chain security, post-quantum cryptography readiness and confidential computing, which are the areas where a control set written for C5:2020 will have nothing to point at. The official catalogue is published on the BSI C5 page.
Who needs C5 2026 transition
Cloud service providers selling into the German public sector and into German enterprises and financial institutions, where a C5 attestation is routinely a procurement precondition. Providers who already hold a C5:2020 attestation and now have a cutover to plan before June 2027. And providers holding ISO 27001 or SOC 2 who are asked for C5 as well and want to reuse the control evidence they already produce.
How the C5 2026 transition maps to the framework
C5 is an attestation standard rather than a certification, which means an auditor tests your described controls against evidence rather than against a checklist. The pack is therefore written as a control environment description with the supporting policy behind each domain, and the cross-domain documents carry the shared responsibility matrix that C5 reviewers always ask for first.
Frequently asked questions
When do we have to be on C5:2026?
Type 1 attestations must meet C5:2026 from 1 June 2027, and Type 2 assessment periods starting on or after that date. Before then you may still attest against C5:2020.
Can we mix C5:2020 and C5:2026 criteria?
No. An attestation is against one catalogue or the other. This is why the cutover needs planning rather than drifting.
What is genuinely new in the 2026 revision?
Subcriteria within each criterion, a machine-readable YAML format, alignment with the EU cybersecurity certification scheme, ISO/IEC 27001:2022 and NIS2, and new material on container management, supply chain, post-quantum cryptography and confidential computing.
How many documents are included?
107 editable Word policies across the eighteen domains, plus a usage guide, an FAQ and a licence file.
We hold ISO 27001. Does that reduce the work?
Substantially. C5:2026 aligns with ISO/IEC 27001:2022, so much of your existing evidence is reusable – but C5 asks for a described control environment and a shared responsibility position that ISO 27001 does not require in that form.
Related toolkits
Cloud providers rarely face one scheme alone. See the ISO 27001 Toolkit for the underlying ISMS, the CSA STAR Toolkit for the Cloud Controls Matrix, the SOC2 Toolkit for US customers and the NIS2 Toolkit for the EU directive C5:2026 now references. The ISO 27017 and 27018 cloud toolkit covers the international cloud codes of practice alongside C5.
Implementing for clients? The Consultant Package licenses all 86 toolkits and assessment tools on this site for unlimited client engagements, under one firm-wide licence. One payment of $1,399, no subscription and no per-client fee.
Delivery, format and licence
Your C5 2026 transition downloads immediately after checkout as native Microsoft Word and Excel files. Nothing is watermarked or locked, so you can rebrand the documents, bring them under your own document control and revise them for as long as you need them.
One-time purchase. No subscription and no annual renewal. Because the source files are yours, revising a procedure after an audit finding or a change of scope is an internal edit rather than another purchase.
Reviews
There are no reviews yet.