BSI C5, Post-Quantum Crypto and Confidential Computing: What German Cloud Platforms Need Running in 2026

BSI’s C5:2026 Cloud Computing Compliance Criteria Catalogue expands Germany’s cloud-assurance framework to 168 criteria across 17 domains, adding focus on post-quantum cryptography, confidential computing, container management, supply-chain security, and digital sovereignty. It applies to Type 2 audit periods beginning on or after 1 June 2027, meaning providers seeking a 2027 attestation need controls operating and generating evidence from the start of their observation period, rather than merely implementing them before an audit. Core cryptography requirements mandate crypto-agility and alignment with BSI or NIST guidance, while optional additional requirements call for a documented PQC strategy including a cryptographic inventory, hybrid encryption, transition triggers, and annual reviews. The article recommends prioritizing hybrid X25519MLKEM768 TLS key exchange, key-management inventories, rotation records, configuration-as-code, and a phased plan for post-quantum signatures and PKI. Confidential-computing criteria address protection of data in use through trusted execution environments and customer-verifiable remote attestation, with available options including Google Confidential GKE Nodes, Azure confidential AKS node pools, and AWS SEV-SNP instances or Nitro Enclaves. It emphasizes that auditors will examine operational evidence such as policies, inventories, attestation reports, access logs, change records, and configuration histories, while noting that cloud-account ownership and platform architecture can affect third-party dependencies, key custody, regional control, and the overall C5 audit scope.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.