What is the Cloud Computing Com­pli­ance Criteria Catalogue?

The Cloud Computing Com­pli­ance Criteria Catalogue (C5) is a catalog of standards specif­i­cal­ly tailored to meet the security needs of cloud computing services. This guide, created by the Federal Office for In­for­ma­tion Security (BSI), acts as a framework for eval­u­at­ing and verifying the security im­ple­men­ta­tions that cloud service providers have in place.

What does the Cloud Computing Com­pli­ance Criteria Catalogue entail?

The C5 Catalogue is a set of criteria published by the Federal Office for In­for­ma­tion Security in 2016. It outlines the minimum standards for secure cloud computing and compiles the re­quire­ments that cloud service providers need to fulfill in order to be rec­og­nized as reliable partners for handling and pro­cess­ing sensitive data.

Currently, the criteria catalog includes 17 topics and addresses more than 120 criteria. The latest edition of the catalog, released in 2020, outlines re­quire­ments in various areas such as:

• Or­ga­ni­za­tion of in­for­ma­tion security
• Security policies and operating pro­ce­dures
• Physical security
• Standard operating pro­ce­dures
• Identity and access man­age­ment
• Cryp­tog­ra­phy and key man­age­ment
• Secure com­mu­ni­ca­tions
• Security incident man­age­ment

Who are the C5 com­pli­ance criteria relevant for?

The criteria described in the catalog are primarily aimed at or­ga­ni­za­tions and companies that provide cloud services. The C5 catalog is par­tic­u­lar­ly important for German cloud service providers and cloud storage providers that manage or store sensitive data. With its uniform standards, it offers a framework that providers can use as a guide to ensure the personal data they store is safe and that security risks are minimized.

It’s not only providers who benefit. Cloud service clients can utilize the criteria catalog to get an un­der­stand­ing of the key aspects of in­for­ma­tion security within cloud computing. This allows them to make a well-informed choice regarding where to store and place their personal data.

What dis­tin­guish­es C5-certified providers?

Generally, providers that achieve the C5 cer­ti­fi­ca­tion dis­tin­guish them­selves by adhering to the rigorous security standards outlined in the BSI’s Cloud Computing Com­pli­ance Criteria Catalogue. As this catalog en­com­pass­es all aspects of in­for­ma­tion security, C5-certified cloud providers are typically regarded as secure. While this does not imply that security incidents are entirely pre­ventable, customers can trust that their data is protected and that any events will be handled in a pro­fes­sion­al way.

Exactly which criteria are met depends on the in­di­vid­ual service provider, as the criteria catalog dis­tin­guish­es between basic and ad­di­tion­al criteria. Basic criteria must be met to receive cer­ti­fi­ca­tion. Ad­di­tion­al criteria, on the other hand, may be fulfilled op­tion­al­ly in order to achieve an even higher level of pro­tec­tion.

What are other security cer­ti­fi­ca­tions?

The C5 cer­ti­fi­ca­tion isn’t the only relevant cer­ti­fi­ca­tion for cloud providers. The criteria in the C5 catalog come from a range of national and in­ter­na­tion­al standards, each of which holds its own sig­nif­i­cance:

• ISO/IEC 27001 cer­ti­fi­ca­tion: Re­quire­ments for in­tro­duc­ing, im­ple­ment­ing, mon­i­tor­ing and improving a doc­u­ment­ed in­for­ma­tion security man­age­ment system
• BSI IT Basic Pro­tec­tion guide: Best practices for im­ple­ment­ing security measures
• ISO/IEC 27002 cer­ti­fi­ca­tion: In­for­ma­tion on im­ple­ment­ing security mech­a­nisms in in­for­ma­tion security man­age­ment systems and on other aspects of in­for­ma­tion security.

The ISO 27001 standard is of par­tic­u­lar im­por­tance for IT service providers and cloud providers. It is much broader than the C5 Cloud Computing Com­pli­ance Criteria Catalogue and covers not only cloud services, but also various aspects of in­for­ma­tion security man­age­ment. In this way, it creates a more general framework for in­for­ma­tion security.