C5:2026: what changes.

• 168 criteria in 17 domains. C5:2020 had 121.
• 462 basic sub-criteria. Additional criteria come in two forms: 29 "additional sharpen" replace a basic sub-criterion with a stricter version, 132 "additional complement" are audited on top.
• Machine-readable for the first time: besides PDF and Excel, the catalogue ships as YAML.
• Aligned with ISO/IEC 27001:2022, CSA CCM v4, the EUCS groundwork (CEN/CENELEC TS 18026) and NIS2.
• The transparency section is now called General Conditions (GC-01 to GC-06), formerly Basic Conditions (BC).

• Binding for Type 1 reporting dates and Type 2 audit periods that start on or after 01.06.2027. Earlier use is permitted.
• Type 2 periods that start before 01.06.2027 run entirely under C5:2020. There is no mixed mode.
• If a Type 2 period ends on or after 28.02.2027, the system description needs additional statements on the planned transition to C5:2026.

In practice: on an annual cycle, your first C5:2026 audit period starts between June 2027 and May 2028. The preparation falls into the coming months, and the transition statements may already be due in your current report.

According to the official changelog, 78 criteria keep their ID, 51 move to a new ID and 39 are new. INQ-01 and INQ-03 from C5:2020 have no successor. Some consultancies say 48 new criteria because they count split criteria. The changelog counts 39.

The biggest growth is in cryptography and key management (CRY, from 4 to 19 criteria), operations (OPS, from 24 to 35), asset management (AM, from 6 to 12), development (DEV, from 10 to 15) and supplier control (SSO, from 5 to 8). Identity and access management is now IAM instead of IDM.

OPS-18 defines what your vulnerability management policy must cover: regular identification of vulnerabilities, CVSS scoring, prioritisation with reference to EPSS and SSVC, handling of systems deliberately left unpatched, and the interface to incident management.

For critical vulnerabilities, engagement must begin promptly after identification, including outside working hours. For high vulnerabilities, within one working day. Deciding not to remediate requires a risk assessment that is reviewed regularly.

One detail that fits awedit: if AI tools are used for vulnerability scans or penetration tests, OPS-18 requires traceable documentation, and the tools are meant to support subject matter experts, not replace them.

OPS-25 requires vulnerability scans at least monthly, daily in the sharpened variant, matched against up-to-date vulnerability databases such as CVE and EUVD. Results feed the SIEM rules so active exploitation is detected. As an example of remediation time frames the catalogue gives: critical 24 to 48 hours, high 48 to 72 hours, medium 5 days, low 1 month. This is an example of a risk-based framework, not a fixed rule.

Guides circulate a three-hour deadline for critical patches. It is not in the catalogue.

Penetration tests (OPS-22) run at least annually and on significant change. With multi-year test plans, every relevant component must be tested at least every three years. Findings get a root cause analysis.

In C5:2020, patching sat inside vulnerability management. C5:2026 gives it its own criteria: OPS-27 for policies and procedures, OPS-28 for implementation. Requirements include testing in a non-production environment, a rollback path, integration into change management, and a post-patch scan confirming the gap is closed.

OPS-29 is new and covers externally sourced components: regularly identify, assess, deploy and monitor updates and known vulnerabilities in third-party and open-source libraries.

DEV-13 adds a maintained list of software components for every developed or integrated component. DEV-14 governs the use of third-party and open-source software, including trusted sources. The catalogue names an SBOM as one possible route, not a mandate. As evidence for DEV-13 and OPS-25, a maintained SBOM is still the obvious choice.

OPS-34 and OPS-35 are new. The policy must cover the full life cycle: image creation, testing and validation, storage and retrieval, deployment, operations and decommissioning. It includes container inventory, logging across the life cycle, separation of customer data, role-based access to the container host, encryption, network monitoring, controlled changes and hardening.

The additional criteria go further: signed container images with a securely stored signing key, runtime monitoring, and regular scans of images and their dependencies. PSS-11 sets out what customers are owed for images, such as origin labelling and hardened images.

• Threat intelligence (OIS-05) and information security in project management (OIS-10).
• Remote working (HR-07, HR-08).
• Separate hardware and software inventories (AM-03, AM-04).
• Separation of datasets (OPS-30, OPS-31) and confidential computing with remote attestation (OPS-32, OPS-33).
• Cryptography across the full key life cycle, including cryptographic change management (CRY-02), external key management (CRY-18) and customer-managed keys (CRY-19).
• Incident response plans (SIM-02) and more transparency in the supply chain (SSO-03, SSO-07, SSO-08).

• Type 1 remains for initial engagements only. If you have the evidence, you can start directly with Type 2.
• A new engagement variant lets the auditor derive the control system, for providers with weak documentation.
• C5:2026 explicitly warns against using the carve-out method to avoid requirements. Your hyperscaler's Testat covers its layers, not yours.
• The Testat still comes exclusively from a Wirtschaftsprüfer. There is no C5 certificate under C5:2026 either.

1. Mapping: map every C5:2020 criterion to its C5:2026 counterpart, using the official changelog.
2. Check the 39 new criteria against existing evidence, starting with OPS, CRY, AM and DEV.
3. Set up evidence over time where a point-in-time proof used to be enough: scan runs, patch history, ticket trails, component lists.
4. Add the transition statements to your system description if your Type 2 period ends on or after 28.02.2027.
5. Engage your auditor early. Qualified auditors report waiting times of 3 to 6 months.

awedit maps your position onto C5:2026, experts prioritise the gaps, the Wirtschaftsprüfer attests.