Do You Need C5? Government, Healthcare, and KRITIS Requirements Explained

Organizations entering the German market often ask the same question: Is C5 mandatory for our business?

The answer depends on your customers, industry, and the cloud services you provide. For some organizations, C5 attestation is a competitive advantage that strengthens customer trust. For others, it is a contractual or regulatory requirement that determines whether they can operate in regulated sectors or participate in procurement opportunities.

If you provide cloud services to government agencies, healthcare organizations, or operators of critical infrastructure, understanding when C5 compliance applies is essential.

» Need help with C5 compliance implementation? Contact GRSee for fast assistance

What Is C5 Compliance?

Many organizations use C5 attestation as independent evidence that a cloud provider has implemented and maintains appropriate security controls.

» Navigate C5 requirements with confidence through expert guidance on cloud security, compliance readiness, and attestation preparation.

Who Needs C5 Compliance?

Organizations that commonly require or benefit from C5 include:

• Cloud service providers supporting government agencies
• SaaS providers processing German healthcare data
• Healthcare organizations selecting cloud vendors
• Critical infrastructure (KRITIS) operators
• Government contractors delivering cloud-based services

Even when C5 is not explicitly mandated, enterprise customers frequently request it during procurement because it demonstrates that cloud security controls have been independently assessed.

Government Sector Requirements

Germany introduced C5 in 2016 to provide a consistent framework for evaluating cloud security providers. Since then, it has become a common requirement in many federal government cloud procurement processes.

Government agencies are generally expected to procure cloud services from providers that can demonstrate compliance with recognized security standards. As a result, C5 attestation is frequently requested during vendor evaluation and procurement reviews.

For cloud providers pursuing public sector opportunities, C5 is often considered a baseline expectation rather than an optional certification.

Why Government Agencies Request C5

Government organizations use C5 to:

• Evaluate cloud provider security practices
• Support procurement and vendor selection processes
• Demonstrate compliance with German security expectations
• Reduce third-party security risks

For many cloud providers, achieving C5 compliance can significantly improve eligibility for government contracts.

Healthcare Sector Requirements

Germany expanded the role of C5 through the Digital Act (DigiG), introducing additional requirements for cloud services used within the healthcare sector.

Beginning in July 2024, many cloud providers handling healthcare data became subject to C5 requirements. During the initial transition period, a C5 Type 1 attestation is generally sufficient.

Understanding the Timeline

Germany introduced healthcare-related requirements in stages to give organizations time to prepare.

July 2024: C5 Type 1 Requirements

Many affected healthcare cloud providers were required to obtain a C5 Type 1 attestation, demonstrating that required security controls had been designed and implemented.

July 2025: C5 Type 2 Requirements

Beginning in July 2025, many providers are expected to hold a C5 Type 2 attestation. Unlike Type 1, Type 2 demonstrates that security controls operate effectively over an extended period, typically six to twelve months.

Why Type 2 Matters

A C5 Type 1 attestation confirms that security controls exist at the time of assessment. A C5 Type 2 attestation goes further by evaluating whether those controls continue to operate effectively throughout an observation period.

For healthcare organizations handling sensitive patient information, this provides stronger assurance that security controls are embedded into day-to-day operations rather than implemented solely for audit purposes.

As a result, Type 2 has become the preferred standard for organizations supporting regulated healthcare environments.

KRITIS and Critical Infrastructure Requirements

C5 also plays an important role for organizations operating Germany's critical infrastructure, commonly referred to as KRITIS.

Hospitals and other critical infrastructure operators increasingly rely on cloud services to support essential operations. As part of ongoing KRITIS oversight, organizations may be required to demonstrate that cloud providers meet applicable security requirements, including C5 where relevant.

Cloud services supporting critical infrastructure may also be subject to data residency expectations requiring sensitive information to remain within Germany, the European Union, or the European Economic Area, depending on contractual and regulatory obligations.

Organizations should evaluate both customer requirements and sector-specific regulations to determine how C5 applies to their environment.

What Happens If You Don't Comply?



Organizations may:

• Lose eligibility for government contracts
• Face challenges selling into regulated industries
• Be unable to support certain healthcare workloads
• Encounter procurement delays
• Experience difficulties during compliance reviews

Hospitals and critical infrastructure operators may also face challenges if their cloud providers cannot demonstrate the required level of security assurance.

Where personal data is involved, organizations must continue to meet GDPR obligations. Depending on the circumstances, non-compliance may result in significant regulatory penalties.

Transitional Options

Organizations that are not yet ready for full C5 attestation may still have options while preparing for compliance.

For some organizations, an existing ISO 27001:2022 certification, combined with a documented implementation roadmap, can help demonstrate progress toward C5 readiness during a defined transition period. This approach is intended to support organizations working toward full compliance rather than replace C5 permanently.

Because transitional arrangements may vary depending on the industry and regulatory requirements, organizations should confirm the specific expectations that apply to their customers and services.

» Learn how C5 and ISO 27001 address cloud security and which certification may be right for your business.

How GRSee Consulting Can Help

Determining whether C5 applies to your organization is only the first step. Preparing for attestation requires understanding regulatory expectations, identifying control gaps, and building the operational evidence needed to support an independent assessment.

GRSee Consulting helps organizations evaluate their C5 readiness, align existing security programs with C5 requirements, and coordinate compliance efforts alongside ISO 27001 and SOC 2 initiatives. By leveraging existing controls wherever possible, we help organizations reduce duplicated effort while preparing for business opportunities in Germany.

» Ready to determine whether C5 applies to your organization? Contact GRSee Consulting to assess your readiness and build a practical roadmap toward C5 compliance.