BSI C5, ISO 27001, TISAX: Which Security Evidence German Buyers Actually Ask For

In German enterprise sales, the security questionnaire arrives before the contract draft — and it rarely accepts “we take security seriously” as an answer. Buyers want evidence they recognise. For SaaS vendors entering the DACH market, the question is not whether to certify, but which evidence opens which doors, and in what order it pays to build it.

Three German peculiarities shape the landscape. Procurement departments work from standardised questionnaires and prefer certificates they can file rather than explanations they must evaluate. Regulated customers — banks under DORA, operators under NIS2 — push their own obligations down the supply chain. And the Federal Office for Information Security (BSI) has created a cloud-specific standard that carries weight far beyond the public sector.

The Baseline: ISO/IEC 27001

ISO 27001 certification of the information security management system is the lingua franca of German procurement. It is internationally recognised, auditable, and demonstrates that security is managed as a process rather than a set of tools. The transition period from the 2013 edition to ISO/IEC 27001:2022 ended in October 2025, so buyers now expect certificates against the current edition. Two details matter in practice: the scope statement — does it actually cover the product and the teams the customer relies on? — and the Statement of Applicability, which sophisticated buyers read line by line.

The German Specialty: BSI C5

The Cloud Computing Compliance Criteria Catalogue (C5) defines minimum requirements for secure cloud services. It is not a certificate but an attestation: an independent auditor reports on the vendor's controls against the C5 criteria — either on their design at a point in time (Type 1) or on their operating effectiveness over a period (Type 2). C5 also demands transparency on data location, jurisdiction, and disclosure to authorities, which is exactly what German customers ask about US-based providers.

In spring 2026, the BSI published C5:2026, the first full revision since 2020. It keeps the established structure, aligns with ISO 27001:2022 and NIS2, and adds criteria for containers, post-quantum cryptography, and confidential computing. Vendors planning a first C5 attestation should build on the new catalogue; those with an existing C5:2020 report should agree the migration path with their auditor.

• Public sector: federal authorities expect C5 for cloud services; many states and municipalities follow.
• Financial services: banks and insurers increasingly request C5 as part of DORA third-party due diligence.
• Healthcare: German rules for cloud use in health data processing reference C5.

The Sector Standard: TISAX

TISAX is the information security assessment of the automotive industry, run by the ENX Association on the basis of the VDA ISA catalogue. If your customers are carmakers or their suppliers, it is not optional — without a TISAX label at the required assessment level, you will not pass supplier onboarding. Outside automotive, nobody asks for it, and investing in it prematurely is money spent in the wrong place.

SOC 2 and the Rest

SOC 2 reports, standard in the US, are accepted by many German buyers as supporting evidence but rarely as a replacement for ISO 27001 or C5. Penetration test summaries, business continuity test results, and a current list of sub-processors complete the typical evidence package. Regulated buyers add DORA- or NIS2-specific questions on incident notification, exit support, and subcontracting chains.

“

German procurement does not buy trust on credit. It buys evidence it can file — and the right certificate saves more sales cycles than the best pitch deck.

The Order That Pays Off

1. 01Start with ISO 27001:2022 — with a scope that genuinely covers the product sold in Germany.
2. 02Add a C5 attestation (Type 1, then Type 2) if you target public-sector, financial-services, or healthcare customers — build it on C5:2026.
3. 03Pursue TISAX only if automotive is a target segment.
4. 04Build a questionnaire library in German and English and a trust center with downloadable evidence under NDA — it shortens every future due diligence.
5. 05Document data location, sub-processors, and access by non-EU authorities in advance; it is the first follow-up question after the certificate.

Conclusion

Security evidence is a sales asset in the German market, not a compliance cost. Vendors who plan their certification roadmap along their target segments turn procurement from a blocker into a formality. Aegiron Capital Group helps SaaS and fintech companies prepare for German enterprise and financial-sector procurement; formal audits, certifications, and attestations come from the accredited auditors and security specialists you engage.