The Cloud Computing Compliance Controls Catalog (C5) was created by the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, or BSI) to provide a framework for assessing the cybersecurity of a cloud service provider and to ensure controls are in place in the event of a cyberattack.
C5 outlines the requirements that cloud service providers must meet in order to provide a minimum security level for their services. The standard combines existing security standards such as ISO 27001, SOC 2 and the BSI’s IT-Grundschutz catalogs with additional C5-specific requirements for increased transparency in data processing.
C5 compliance is required for cloud services used by the German government and organizations that work with Germany's public sector. C5 assessments are performed in accordance with the International Standard on Assurance Engagements (ISAE) 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information.
Reports and other documentation
The C5 reports for the services listed in the “services in scope” section are protected and available upon request. To request the IBM Cloud infrastructure, IBM Cloud VPC, and/or IBM Cloud PaaS/Cloudant C5 reports:
Current and potential IBM clients can use the C5:2020 reports as verification of cloud security compliance and as part of their assessment for using IBM Cloud.
The C5 reports are of particular interest to IBM’s clients, with offices in the European Union (EU), or other global clients that seek to find a comprehensive cloud computing control framework.
C5 reports may be provided for IBM services that have implemented controls in accordance with the C5 framework and have been assessed by an independent auditor, demonstrating proof of compliance with C5.
The services listed below have a C5 report available, representing a period of time during which controls were assessed.
IBM Service Descriptions (SD) indicate if a given offering maintains C5 compliance status. Services below issue C5 reports at least once each year.