biz59BSI C5 for a small SaaS selling into German healthcare: what section 393 requires, who audits it and what Type 1 and Type 2 cost
Since 1 July 2025 section 393 SGB V asks for a C5 Type 2 attestation for cloud services that handle patient data; new systems get 18 months on Type 1. A dated calendar for a December 2026 launch, who may audit, the published price ranges (EUR 5,000 to 25,000 gap analysis, 40,000 to 120,000 attestation), what a host's report does not cover and how C5:2026 changes the plan.
A German clinic, a doctor's practice or a health insurer wants to use your software. It will hold patient data on a cloud server. Before the contract is signed, someone in their IT team asks for your "C5 Testat". If you have never heard the word, this is the article for that afternoon.
C5 is a German cloud security catalogue from the BSI, the federal cyber security office. Since 1 July 2025 the law behind it, section 393 of the fifth Social Code (SGB V), asks for the stronger Type 2 report for cloud services that process patient and health insurance data. New products get 18 months on the lighter Type 1 report first. This piece goes through what the law says, a worked date calendar for a product launched on 1 December 2026, who is allowed to audit it, what the published price ranges are (and where I could not find a real quote), and what you can and cannot take from your cloud host. It is not legal advice: have a lawyer or your customer's data protection officer confirm your own case.
The short version
- Section 393 SGB V lets clinics, practices, hospitals, health and care insurers and their processors use cloud computing for social and health data only if the conditions in paragraphs 2 to 4 are met. One of them is a current C5 attestation for the cloud systems.
- Since 1 July 2025 the attestation must be Type 2 (it tests that controls worked over a period). A system first placed on the market after 30 June 2025 may use Type 1 for its first 18 months; from month 19 it needs Type 2.
- Only a public auditor (Wirtschaftsprüfer) can sign a C5 report. The BSI itself does not certify anyone.
- Your host's C5 report does not replace yours. The attestation has to cover the service that processes the data, which is yours. The host's controls are usually carved out and relied on.
- Published price ranges from German consultants: gap analysis EUR 5,000 to 25,000, consulting and a measures plan EUR 20,000 to 60,000, the attestation itself EUR 40,000 to 120,000. A first-timer with no security management system is told to expect over EUR 200,000 in all. These are consultant ranges, not signed quotes, and I label them that way below.
- A new catalogue, C5:2026, applies to Type 2 periods that begin on or after 1 June 2027. It has 168 basic criteria instead of 121.
What section 393 SGB V says
The text is on gesetze-im-internet.de. The parts that matter for a software vendor, in plain words:
Two things people miss. First, the customer is in the law too: paragraph 3 says the customer-side criteria listed in your report have to be implemented. Your report will contain a list of complementary user entity controls (CUECs), such as who may hold admin accounts on their side. A practice that ignores them loses its footing, so you will be asked to explain them. Second, the location rule applies to remote support: Kertos points out that support access from a third country without an adequacy decision is a problem too, and standard contractual clauses do not change it. If your developer sits in India and can open a customer's production database, that is the first conversation to have.
A worked calendar: a product launched on 1 December 2026
Take a new patient-reminder product, placed on the market on 1 December 2026, with no ISMS (information security management system) yet. Counting months as the law does, month 1 is December 2026 and month 18 is May 2028.
Kertos puts a first Type 2 at an observation period of 3 to 12 months, usually 6, and the whole road at 7 to 14 months with an existing ISO 27001 style ISMS and 12 to 20 months without one. A Type 1 can be done in 4 to 8 weeks of audit work according to another consultant, but Securance describes waits of 3 to 6 months just to get an audit date. So the Type 1 is not a fast pass: book the auditor the day you decide.
Who audits it
A C5 report is an assurance report under the ISAE 3000 standard, and by the rule Rödl describes, only Wirtschaftsprüfer and Wirtschaftsprüfungsgesellschaften (public auditors and their firms) may issue it. The BSI publishes the catalogue and does not sign anyone's report. That has two effects. The auditors are private firms that set their own fees, and the market is not like ISO 27001, where an accredited body certifies. Ask for a quote with three things written down: Type 1 or Type 2, the systems in scope, and whether the gap analysis is included.
A Type 1 report says the controls are suitably designed on one date. A Type 2 adds that they worked over a period. Securance, which says it has supported more than 50 C5 attestations, notes that C5 is often a startup's first big compliance hurdle.
What it costs: the published ranges
I could not find a single published, signed quote for a small company. Auditors quote per job. What exists is ranges on consultant pages. Here they are with their source, so you can see how far apart they are:
Add them up for a product with no ISMS, using the ends of the ingenieur.de ranges:
Treat Path A as a ceiling: the second attestation is normally cheaper than the first, as Kertos notes of follow-up audits, and the ranges overlap because they come from different sellers. The only fair reading is that a small vendor should budget somewhere between EUR 50,000 and EUR 200,000 over two years, with the staff time on top, and get at least two written quotes before believing any of the numbers. Several consultants sell the ranges they also sell the work for, so the figures are not independent.
What you can take from your cloud host
This is the question every small vendor asks: "My host already has C5, do I inherit it?" Not entirely. Kertos reads section 393 as requiring the attestation from the party that processes the data, which is you. In an audit the host's infrastructure is usually carved out: your auditor does not test their data centres, they rely on the host's own report and test how you use the service. The SOC 2 world calls this the carve-out method, and the same idea applies here, but check the wording of your own report, because the C5 treatment of subservice providers was not something I could confirm from a primary page.
Examples as of November 2026: Hetzner announced on 25 March 2026 that it received the C5 Type 2 attestation; its news page names neither the services nor the locations, so ask for the report and read the scope before you rely on it. For AWS and Microsoft Azure the reports come from AWS Artifact and the Microsoft Service Trust Portal, and a search for them did not show which services and regions are covered, so read the report's scope page against the exact services you run. IONOS is named as holding a C5 attestation by Securance, without the type. Whatever the host, three checks on its report: the services you use are in the scope, the reporting period is current, and the Type is 2.
The ISO 27001 bridge: the C5-Gleichwertigkeitsverordnung
Section 393 allows a comparable standard instead of C5, and a regulation published on 19 March 2025 (BGBl. 2025 I Nr. 91) lets an ISO/IEC 27001 certificate bridge the gap for a limited time. As summarised by Kertos and KPMG, you need four things: documentation of the C5 basic criteria not yet met, measures to close them, a milestone plan to close them within 12 months, and then a Type 1 attestation within 18 months and a Type 2 within 24 months of creating the plan. The plan and the certificate go to customers and the supervisory authority on request. I have not read the regulation itself, so check the exact conditions in the Bundesgesetzblatt. Securance describes the transition as 21 months, which does not match the 24, so ask your auditor which one applies to you.
That is later than the 1 June 2028 for a brand new product above, because it starts when you write the plan, not when the product launches. The two routes are for different starting points: a product on the market after June 2025 uses the 18-month rule; a company that is already certified and is fixing a known list of gaps uses the bridge.
C5:2026: the catalogue changes while you are in the queue
The BSI published C5:2026 on 7 April 2026 and it replaces the 2020 edition (heise). Per Kertos: Type 1 attestations with a reference date on or after 1 June 2027, and Type 2 periods that begin on or after that date, must use C5:2026. Audits that end before 28 February 2027 can run entirely under C5:2020. The new catalogue has 168 basic criteria (121 before) plus 89 additional ones in 17 subject areas, and only the basic criteria matter for section 393. Container management was heavily revised, post-quantum encryption is added, and providers must state the law they are subject to and where customer data is.
Practical effect: if you build your controls against C5:2020 for the Type 1, you will do a second round of mapping for the Type 2. Build to the 2026 list from the start if the Type 1 date is after the spring of 2027.
Do you need it at all?
- You need it if you are a processor of patient or insurer data in the cloud for a covered customer. Your customer's data protection officer decides that, so ask them early what they consider in scope.
- You may not need it if no social or health data goes to your cloud: scheduling that stores only names and times, or a tool that runs on the customer's own machine, may fall outside. Do not decide this yourself; write the question down and get the customer to answer it in writing.
- If the customer is a critical-infrastructure hospital, paragraph 6 says the extra measures do not apply on top of what section 8a BSIG already demands from the operator.
- If you already hold ISO 27001 or are heading for SOC 2, the C5 work overlaps a lot. We cover those two in ISO 27001 or SOC 2 when the customers are in Europe and SOC 2 for a five-person SaaS.
Before the first call with an auditor
A customer's security questionnaire is usually the first place C5 shows up. We wrote about answering those honestly in the security questionnaire article.
Before you ask an auditor for a quote, score your product against the 25 Minimum Viable Secure Product controls and see which gaps a German buyer will find first.
Open the security baseline self-assessmentSources
§ 393 SGB V, Cloud-Einsatz im Gesundheitswesen (gesetze-im-internet.de) (paragraphs 1 to 8 as summarised above); KPMG: C5-Gleichwertigkeitsverordnung (publication on 19 March 2025, 12, 18 and 24 month periods; as read in search summary); Kertos: C5 attestation for health SaaS and Kertos: practical guide to C5 (timelines, C5:2026 dates and criteria counts, observation periods); ingenieur.de: Was bringt die C5-Zertifizierung wirklich (24 August 2025) (cost ranges, no named source in the article); Securance: BSI C5-Markt 2025 (cost ranges and waits, marketing content from an auditor); Rödl: C5-Testat nach ISAE 3000 (who may audit); heise: C5:2026 (7 April 2026); Hetzner: C5-Testat Typ 2 (25 March 2026); BVMed info sheet on C5 and section 393 (January 2026). Cover photo: Pexels 1148820 (Pexels License). Not checked against a primary source: the exact wording of the C5-Gleichwertigkeitsverordnung, the C5:2026 transition dates (Kertos only), and whether AWS and Azure Frankfurt services hold Type 2 reports. The calendars and cost totals are our own arithmetic on the cited ranges.