Cybersecurity excellence at NFON
C5 attestation: NFON's commitment to cloud security.
The Cloud Computing Compliance Criteria Catalogue (C5) was developed by the German Federal Office for Information Security (BSI) to establish minimum security requirements for cloud services.
Based on internationally recognised security standards, the catalogue covers many key areas such as information security, access management, incident response and business continuity. It also promotes transparency around aspects such as data location and applicable legal jurisdictions.
Through independent audits, C5 enables cloud providers to demonstrate how their security controls are assessed against defined criteria. For customers and partners, it provides a recognised framework for evaluating cloud security, understanding potential risks and making informed decisions.
NFON's C5 Type 2 achievement
NFON has progressed from C5 Type 1 to Type 2, representing a significant step forward in independent security assurance.
Type 1: Assesses whether security controls are appropriately designed and implemented at a specific point in time.
Type 2: Goes further by evaluating how effectively those controls operate over a defined period.
This additional assessment provides stronger evidence of how security measures function in practice.
Frequently asked questions (FAQ)
Is C5 a certification or an attestation?
C5 is an attestation framework rather than a traditional certification. Independent auditors evaluate cloud services against security criteria established by the German Federal Office for Information Security (BSI). The resulting report provides transparency into the assessed security controls and their effectiveness.
Which NFON services are covered by the C5 Type 2 attestation?
NFON's published C5 Type 2 attestation covers Cloudya, its cloud-based telephone system. The assessment focuses on the internal controls relevant to delivering this service against the applicable C5 security criteria.
Is C5 relevant for organisations in regulated industries?
Yes. C5 provides a recognised framework for evaluating cloud security and can support risk assessments and compliance processes in sectors such as healthcare, finance and public administration. However, an attestation alone does not automatically establish compliance with every single industry-specific regulation. You can contact us for your industry specific questions.
What is the difference between C5 Type 1 and Type 2?
C5 Type 1 assesses whether security controls are appropriately designed and implemented at a specific point in time. Type 2 goes further by evaluating their operating effectiveness over a defined period, providing a more comprehensive assessment of security practices. NFON's assessment was carried out over a period of 18 months.
Who conducted NFON's C5 Type 2 assessment?
The assessment was conducted by ADVANTA GmbH, an independent auditing firm, in accordance with the international assurance standard ISAE 3000 (Revised).
Is C5 relevant outside of Germany?
Although developed by Germany's Federal Office for Information Security (BSI), C5 draws on internationally recognised standards and can be relevant to organisations operating across borders.