C5 Certification: Insiders Delivers Measurable Compliance Relief for Cloud Customers
The C5 Certification confirms the continuously audited operation of Insiders’ cloud services. Customers save on audit efforts, accelerate approval processes, and sustainably reduce their compliance costs.
C5 Certification as a Recognized Audit Standard for Cloud Services
The C5 certification is based on the Cloud Computing Compliance Controls Catalog, or C5 for short, which was developed by the Federal Office for Information Security (BSI). It defines binding minimum requirements for secure cloud computing and serves as a recognized benchmark for companies and public sector clients to evaluate the security of cloudservices.
As part of the audit, more than 120 criteria are evaluated by independent auditors. These include, among other things, robust access controls, role-based authorization models, encrypted data transmission and storage, GDPR-compliant processing of personal data, documented emergency and disaster recovery plans, redundant system architectures to ensure availability, as well as structured processes for incident management and security reporting. Transparency requirements toward customers, as well as clear regulations on data localization, are also part of the audit. For users, this means a level of security in accordance with the highest German standards.
The audit for the Type 2 attestation is considered particularly rigorous because it not only describes the design of security measures but also verifies their ongoing operation. It thus provides robust evidence for regulatory authorities, data protection agencies, and internal audits.
As of July 1, 2025, a C5 Type 2 certification is mandatory when cloud services in Germany process social or health data. This certification is also increasingly required in regulated industries such as the financial sector, public administration, and among operators of critical infrastructure.
Less audit effort, lower costs, faster approvals
For Insiders’ clients, the C5 certification delivers an immediate economic benefit. In regulated environments, companies are required to regularly assess and document the security of their service providers. Without standardized verification, this results in high internal costs for risk analyses, supplier evaluations, audit discussions, and documentation requirements.
The C5 Type 2 certification for Insiders’ AI cloud services significantly reduces this effort. Customers can rely on recognized and verified security certification instead of having to conduct their own time- and cost-intensive individual audits.
“Regulatory requirements result in significant indirect costs for many organizations,” says Dr. Alexander Swienty, Head of Channel Management at Insiders. “With the C5 Type 2 certification, we take on a large portion of this testing burden. Our customers benefit from clear evidence, shorter coordination processes with regulatory authorities, and a significant reduction in the allocation of internal resources.”
Supplement to ISO 27001 Certification
Insiders already holds ISO 27001 certification for its information security management system. While this certification confirms the structured management of information security, the C5 attestation additionally verifies the secure operation of specific cloud services. For customers, this provides a robust foundation for security and compliance.
Read more about the differences between the C5 attestation and ISO 27001 certification.
Integrated compliance verification without additional effort
Insiders integrates the C5 Testat into its business model via a transparent assurance fee. For customers, this means no separate audit project is required; instead, they receive pre-audited and documented proof of security that can be used immediately to meet their own compliance requirements.
The attestation is renewed annually, thereby ensuring security standards that can be verified on an ongoing basis. For customers, this means regulatory stability, predictable costs, and significantly less administrative effort during day-to-day operations.
