Guides
Regulation, explained.
What applies, from when, to whom. Every guide names its sources and the date of its last review.
BSI C5
Go to the C5 page →- C5:2026: what changes from C5:2020 and when it appliesC5:2026 has 168 criteria instead of 121 and applies to audit periods from 01.06.2027. What changes in patch, vulnerability and container management, with criterion IDs.
- C5 Type 2 Testat: process, duration and costHow a C5 Type 2 Testat works: audit period of 3 to 12 months, Wirtschaftsprüfer under ISAE 3000 / IDW PS 860, market prices of €60k to €120k. And what §393 SGB V requires.
- C5 Zertifizierung vs. Testat: why there is no C5 certificateBSI C5 does not end in a certification. It ends in a Testat issued by a Wirtschaftsprüfer. What the difference means, what §393 SGB V requires, and how to prepare.
- C5 vs. ISO 27001: differences, overlap, sequencingBSI C5 and ISO 27001 are not interchangeable. What each standard delivers, where they overlap, and in what order SaaS vendors should tackle both.
- Who is affected by NIS2 in Germany? Check scope in five stepsNIS2 has applied in Germany since 06.12.2025 through the BSI Act. Whether your company is in scope depends on sector, size and special cases. A step-by-step check with the thresholds of §28 BSIG.
- NIS2 registration with the BSI: process, data, deadlinesEntities in scope must register with the BSI under §33 BSIG. How it works via Mein Unternehmenskonto and the BSI portal, which data is required, and what applies if you missed the deadline.
- NIS2 requirements in Germany: all duties under the BSIG as a checklistWhat NIS2 requires of companies in scope: registration, ten risk management measures under §30 BSIG, incident reporting, management duties. With deadlines and what does not apply yet.
- Who is affected by the BFSG? Products, services, exemptionsGermany's Accessibility Strengthening Act (BFSG) has applied since 28.06.2025 to certain consumer products and services. Which companies are affected, what is exempt and which transition periods run.
- Accessibility statement under the BFSG: mandatory content and common mistakesUnder §14 and Annex 3 of Germany's BFSG, service providers must publicly state how their offering meets the accessibility requirements. What it must contain, where it must appear and which mistakes are common.