Road to C5: Our Journey to the BSI Attestation
Security is easy to promise. It becomes decisive where it has to be proven. This is exactly why the extensive criteria catalogue of the C5 attestation was developed by the German Federal Office for Information Security (BSI). The five C’s stand for Cloud Computing Compliance Controls Catalogue.
Just another certificate among many? No. Unlike more general information security certifications such as ISO 27001, C5 is specifically designed for cloud services and evaluates their security, transparency, and traceability in concrete terms. Customers therefore receive a practical and comparable proof of a provider’s trustworthiness.
The Road to the Audit Deadline
An attestation does not begin on the day of the audit. It starts much earlier, with many details that may seem self-evident in everyday operations but need to be properly documented for an audit.
“Due to our increased protection requirements under our ISO 27001 certification based on BSI IT-Grundschutz, we were already able to lay a very robust foundation for the C5 attestation. Despite our internal security standards, many processes and technical details had to be adapted to C5. The fact that this worked so smoothly is thanks to our fantastic centron team,” summarizes centron CEO Dominik Seucan.
On the audit date in May 2026, we successfully completed the audit. This means that the security measures of our cloud were independently reviewed and can now be demonstrated to our customers in a transparent and traceable way. An important signal for data security and data sovereignty.
An Attestation for Greater Customer Trust
The C5 attestation ensures better comparability of security standards among cloud providers. The audit examined whether the strict requirements of the BSI, such as data encryption and physical data center security, are met. Data processing takes place exclusively in a German data center and under German law.
Dominik Seucan explains why the attestation is so important for centron: “The C5 attestation was the next logical step. Both to meet the legal requirements of our customers and to continue progressing toward our compliance goals. It creates additional trust and gives even more companies the opportunity to operate their cloud infrastructure at centron.”
The attestation is particularly important for customers with special requirements regarding compliance, data protection, and information security, including public authorities, public institutions, and regulated industries such as the medical sector.
The Next Milestone Comes in 2027
By successfully passing the audit, we have now received the C5 Type 1 attestation. This assesses the design and implementation of the measures at a specific point in time. The next step is the Type 2 audit. This will examine the effectiveness of the measures during ongoing operations over a defined period of 12 months.
You may also be interested in:
Energy-Efficient and Secure – Our ISO 27001 Certified Data Center
