The Testat is coming. We get you ready.
awedit gets cloud and SaaS providers ready for the BSI C5 Testat. AI scans your setup against all 121 criteria, experts review every finding, and you walk to the Wirtschaftsprüfer with a report they actually want to see.
Orientation, not evidence.
Criteria matched automatically against your cloud setup.
Structured, audit-grade documentation end to end.
Every finding is signed off by a person who stands behind it.
AI detects. Experts decide. Auditors attest.
§393 SGB V requires a Typ-2-Testat for cloud processing of health and social data.
C5:2020 reports with periods ending after this date must already disclose C5:2026 migration plans.
C5:2026 becomes binding: 168 criteria, 462 sub-criteria. The re-mapping wave is real.
How it works
We scan.
AI-assisted analysis of your organisation, product and evidence against the C5 basic criteria. Every gap gets a criterion ID, not a vibe.
We fix.
A prioritized remediation plan, sequenced the way auditors think: observation-period killers first, engineering lead-time second, paperwork last.
They sign.
Your Wirtschaftsprüfer gets a handover pack built for their acceptance logic. We prepare, they attest. That separation is not a limitation, it is the law, and it keeps everyone conflict-free.
Where do you stand? Two minutes. Zero cost. Aha included.
Twelve questions, instant orientation across your §393 exposure, your catalog window and your biggest gaps. No account, no sales call, no PDF ambush.
One report, three audiences.
Management gets the executive gap picture and the cost/timeline reality. Your team gets 121 criterion-level findings with priorities and owners. Your auditor gets a Systembeschreibung skeleton and a control matrix in the structure they test against. Handover-ready means exactly that.
Executive gap picture
Cost and timeline reality, in one page.
121 criterion-level findings
Priorities and owners, ready to work.
Systembeschreibung skeleton
Control matrix in the structure they test against.
AI = Actual Intelligence.
Our scanner reads artifacts fast and never gets tired. Our experts overrule it whenever context beats pattern. Every finding in your report has passed a human who signs their name under their judgment. The only signature we never provide is the one under the Testat: that belongs to the Wirtschaftsprüfer, exclusively, and we would not have it any other way.
§393 SGB V§393 SGB V is not a suggestion.
Health and social data in the cloud requires a current C5 Testat over the basic criteria, EU/EEA processing, and implemented customer-side controls. Enforcement runs through procurement: the Kasse asks, the contract answers. We keep you ready for the asking. If you ride the C5GleichwV bridge, we map your gap analysis and milestone plan so the bridge ends on solid ground, not in July 2027 fog.
Binding for audit periods starting on this date under §393 SGB V.
Orientation, not evidence.
168 criteria are coming. Your 121 will move.
Of the 168 criteria in C5:2026: 78 keep their C5:2020 ID, 51 are remapped to new IDs, 39 are brand new. On the 2020 side, only two criteria retire without a successor. Your report shows the delta today, so the 2027 audit period does not start with archaeology.
Pick your engagement.
Four tiers, one direction: readiness.
Full 17-domain analysis, expert-reviewed, handover-ready report.
Talk to usOrientation, not evidence.
Fair questions.
01Is there a C5 certificate?
No. There is no C5 certificate, only a Testat issued by a Wirtschaftsprüfer after an ISAE 3000 / IDW PS 860 engagement. Anyone selling you 'C5-zertifiziert' is selling you a category error.
02Can a tool make me compliant?
No tool alone achieves readiness or compliance, including ours. AI detects, experts decide, auditors attest.
03Does my hyperscaler's Testat cover me?
No. AWS, Azure and GCP Testate cover their layers. Your SaaS layers need their own. The prevailing legal view for §393: the SaaS vendor itself needs the Testat.
04What does a Testat cost?
Market signals: €60k to 120k for a classic Typ 2 engagement, more without an ISMS baseline, plus 3 to 6 months of auditor waitlist. Preparation quality is the main cost lever, and the one you control.
05Typ 1 or Typ 2?
Typ 1 exists once, for first-timers. §393 requires Typ 2 since 01.07.2025; new-to-market systems (after 30.06.2025) get an 18-month Typ-1 lane. We map your case in the Self-Check.