The Cloud Computing Compliance Controls Catalog (C5) was created by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, or BSI) to provide a framework for assessing the cybersecurity of a cloud service provider and to ensure controls are in place in the event of a cyberattack. 

C5 outlines the requirements that cloud service providers must meet in order to provide a minimum security level for their services. The standard combines existing security standards such as ISO 27001, SOC 2 and the BSI’s IT-Grundschutz catalogs with additional C5-specific requirements for increased transparency in data processing.

C5 compliance is required for cloud services used by the German government and organizations that work with Germany's public sector. C5 assessments are performed in accordance with the International Standard on Assurance Engagements (ISAE) 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information.

Reports and other documentation

The C5 reports for the services listed in the “services in scope” section are protected and available upon request. To request the IBM Cloud infrastructure, IBM Cloud VPC, and/or IBM Cloud PaaS/Cloudant C5 reports:

• Contact an IBM representative