What is the Cloud Computing Com­pli­ance Criteria Catalogue?

The Cloud Computing Com­pli­ance Criteria Catalogue (C5) is a catalogue of standards spe­cific­ally tailored to meet the security needs of cloud computing services. This guide, created by the Federal Office for In­form­a­tion Security (BSI), acts as a framework for eval­u­at­ing and verifying the security im­ple­ment­a­tions that cloud service providers have in place.

What does the Cloud Computing Com­pli­ance Criteria Catalogue entail?

The C5 Catalogue is a set of criteria published by the Federal Office for In­form­a­tion Security in 2016. It outlines the minimum standards for secure cloud computing and compiles the re­quire­ments that cloud service providers need to fulfil in order to be re­cog­nised as reliable partners for handling and pro­cessing sensitive data.

Currently, the criteria catalogue includes 17 topics and addresses more than 120 criteria. The latest edition of the catalogue, released in 2020, outlines re­quire­ments in various areas such as:

• Or­gan­isa­tion of in­form­a­tion security
• Security policies and operating pro­ced­ures
• Physical security
• Standard operating pro­ced­ures
• Identity and access man­age­ment
• Cryp­to­graphy and key man­age­ment
• Secure com­mu­nic­a­tions
• Security incident man­age­ment

Who are the C5 com­pli­ance criteria relevant for?

The criteria described in the catalogue are primarily aimed at or­gan­isa­tions and companies that provide cloud services. The C5 catalogue is par­tic­u­larly important for German cloud service providers and cloud storage providers that manage or store sensitive data. With its uniform standards, it offers a framework that providers can use as a guide to ensure the personal data they store is safe and that security risks are minimised.

It’s not only providers who benefit. Cloud service clients can utilise the criteria catalogue to get an un­der­stand­ing of the key aspects of in­form­a­tion security within cloud computing. This allows them to make a well-informed choice regarding where to store and place their personal data.

What dis­tin­guishes C5-certified providers?

Generally, providers that achieve the C5 cer­ti­fic­a­tion dis­tin­guish them­selves by adhering to the rigorous security standards outlined in the BSI’s Cloud Computing Com­pli­ance Criteria Catalogue. As this catalogue en­com­passes all aspects of in­form­a­tion security, C5-certified cloud providers are typically regarded as secure. While this does not imply that security incidents are entirely pre­vent­able, customers can trust that their data is protected and that any events will be handled in a pro­fes­sion­al way.

Exactly which criteria are met depends on the in­di­vidu­al service provider, as the criteria catalogue dis­tin­guishes between basic and ad­di­tion­al criteria. Basic criteria must be met to receive cer­ti­fic­a­tion. Ad­di­tion­al criteria, on the other hand, may be fulfilled op­tion­ally in order to achieve an even higher level of pro­tec­tion.

What are other security cer­ti­fic­a­tions?

The C5 cer­ti­fic­a­tion isn’t the only relevant cer­ti­fic­a­tion for cloud providers. The criteria in the C5 catalogue come from a range of national and in­ter­na­tion­al standards, each of which holds its own sig­ni­fic­ance:

• ISO/IEC 27001 cer­ti­fic­a­tion: Re­quire­ments for in­tro­du­cing, im­ple­ment­ing, mon­it­or­ing and improving a doc­u­mented in­form­a­tion security man­age­ment system
• BSI IT Basic Pro­tec­tion guide: Best practices for im­ple­ment­ing security measures
• ISO/IEC 27002 cer­ti­fic­a­tion: In­form­a­tion on im­ple­ment­ing security mech­an­isms in in­form­a­tion security man­age­ment systems and on other aspects of in­form­a­tion security.

The ISO 27001 standard is of par­tic­u­lar im­port­ance for IT service providers and cloud providers. It is much broader than the C5 Cloud Computing Com­pli­ance Criteria Catalogue and covers not only cloud services, but also various aspects of in­form­a­tion security man­age­ment. In this way, it creates a more general framework for in­form­a­tion security.