C5 Type 2 Testat: process, duration, cost.

A Type 1 Testat confirms on a reporting date that your controls are suitably designed. It is meant for initial engagements only. Every follow-up is Type 2.

A Type 2 Testat also confirms that the controls operated effectively over a period. The audit period runs at least 3 and at most 12 months, usually 6 to 12 in practice. If you have the evidence, you can start directly with Type 2.

Only a Wirtschaftsprüfer (German public auditor), in an engagement under ISAE 3000 (Revised) or IDW PS 860. The BSI writes the catalogue but does not audit and issues no certificate. Other specialists may join the audit team, only the Wirtschaftsprüfer signs.

That is why the correct term is "attested against C5", never "C5 certified". Our guide on certification versus Testat explains why this matters.

• §393 SGB V: healthcare providers, statutory health and care insurers and their processors may process health and social data in the cloud only if the data-processing entity holds a current C5 Testat over the basic criteria. Since 01.07.2025 it must be Type 2.
• IT systems first placed on the market after 30.06.2025 may rely on a Type 1 Testat for their first 18 months (BEEP act, in force since 01.01.2026).
• Transitional route under the C5 equivalence ordinance: ISO 27001, ISO 27001 based on IT-Grundschutz or CSA CCM v4, but only with a documented gap analysis and action plan. Type 1 must follow within 18 months, Type 2 within 24.
• German federal agencies require C5 through the BSI minimum standard for external cloud services and EVB-IT Cloud.

Your hyperscaler's Testat is not enough. AWS, Azure and Google Cloud attest their layers, not your SaaS application. That the SaaS vendor needs its own Testat is the prevailing reading of §393, based on the health ministry's position. There is no case law yet.

1. Define scope: which services, which regions, which service organisations. For hyperscalers and other subservice providers, choose between carve-out (their report is referenced) and the inclusive method.
2. Gap analysis against the basic criteria. For audit periods starting before 01.06.2027 that is C5:2020 with 121 criteria, afterwards C5:2026 with 168.
3. Close the gaps: policies, processes, technical controls, system description, management statement.
4. Engage the auditor. Qualified auditors report waiting lists of 3 to 6 months.
5. Run the audit period and collect evidence across the whole period, not just on one date.
6. Audit and report. The report also lists the controls your customers must implement themselves and the controls of your subservice providers.

Preparation 3 to 6 months, audit period 6 to 12 months. 12 to 18 months to the first Type 2 report is a realistic frame. A working ISMS puts you at the lower end.

• Gap analysis: €5k to €25k.
• Consulting and remediation plan: €20k to €60k.
• Type 1 or Type 2 Testat: €40k to €120k. A classic Type 2 engagement sits at €60k to €120k according to auditors.
• Small providers without an ISMS: more than €200k in total is possible.

These are market signals from trade press and vendor statements, not fixed prices. The biggest lever is preparation: the more complete your scope, evidence and system description are when the auditor starts, the shorter the audit. If you already hold ISO 27001, evidence can be reused in a combined engagement.

Correct phrasing is, for example: "C5 Type 2 Testat for the period [start] to [end]". A Type 2 Testat has no formal expiry because it covers a past period. Customers still expect annual follow-up reports. According to the BSI, customers must read the report themselves and feed it into their own risk management. The Testat does not replace their review.