Is C5 mandatory?

Is C5 Certification Mandatory for Healthcare in Germany?

When it comes to cloud security in Germany, the BSI C5 has become a cornerstone. Developed by the Federal Office for Information Security (BSI), it sets rigorous standards for secure cloud services. While C5 compliance is widely adopted across various sectors as a best practice, it’s not universally mandatory—except in one critical area: healthcare.

The requirement specifically calls for a C5 Type 2 attestation, which goes beyond a simple checklist. Unlike Type 1, which evaluates design at a single point in time, Type 2 confirms that security measures have been effectively implemented and consistently maintained over a minimum period—usually 12 months. This means providers must prove not only that their systems are secure by design, but also that they operate securely in practice.

For healthcare providers and their technology partners, this isn’t just about compliance—it’s about accountability. As digital health services expand, from electronic patient records to telemedicine platforms, the need for verifiable security grows more urgent.

While organizations outside healthcare may voluntarily pursue C5 to build trust and improve security posture, those in the medical field now have no choice. By enforcing C5 Type 2, Germany is sending a clear message: when sensitive patient data is involved, security must be both rigorous and provable. And as of 2025, that standard is non-negotiable.