Cloud Services
Classified Cloud
Managed Services
Kubernetes
Public Sector
Defense & Space
Homeland Security
Healthcare
Regulated Industries
Critical Infrastructure
Enterprise IT-Modernization
SaaS & Digital Platforms
Cloud Services
Classified Cloud
Managed Services
Kubernetes
Certifications as Reliable Proof
Structure of Our Certifications
The certifications build on one another and cover different levels of requirements—from core regulatory requirements to supplementary technical and data protection-related evidence.
BSI C5 Type 2
Core certification for government agencies and regulated customers in Germany. The federal government and many public agencies use the BSI minimum standard for external cloud services as the authoritative framework for their own risk assessments—without this certification, gaining access to this customer segment is virtually impossible in practice.
ISO 27001 Based on IT-Grundschutz
An organizational foundation and a complement to German expectations. While the native ISO 27001:2022 standard appeals to internationally oriented enterprise customers and corporations, certification based on IT-Grundschutz reflects the specific German security methodology and strengthens a company’s position with government agencies and public sector clients.
ISO 27017 and ISO 27018
Technical and data protection-related additions to ISO 27001. ISO 27017 provides more detailed evidence of information security specifically in cloud services, while ISO 27018 demonstrates the protection of personal data—both of which strengthen the case when presenting to compliance, security, and data protection teams.
ISO 14001
Environmental management system for the operation of cloud platforms. Energy consumption, data center operations, and the supply chain have a direct environmental impact—certification ensures transparency in how these issues are systematically addressed and is increasingly becoming a factor in the selection process for regulated and larger corporate customers.
Which Certification Is Right for Which Need
BSI C5 Type 2 and ISO 27001 based on IT-Grundschutz—both certifications are directly used for risk assessment in public sector solicitations.
ISO 27001:2022 (native) – relevant for global audits and standardized ISMS requirements outside the German regulatory context.
ISO 27017 and ISO 27018 – complementary standards for cloud-specific information security and the protection of personal data.
ISO 14001 – relevant when environmental management is part of the evaluation framework for supplier selection.
Does BSI C5 also cover classified information (VS-NfD)?
No. BSI C5 is a security standard for general-purpose cloud services and does not constitute authorization for classified information. The processing of information classified from VS-NfD up to VS-GEHEIM requires a separate BSI operational authorization, which is covered by SINA products—not by C5.
Why have two ISO 27001 certifications at the same time?
The native ISO 27001:2022 standard and certification based on IT-Grundschutz address different audit approaches—international ISMS standardization on the one hand, and the German BSI methodology on the other. For mixed client portfolios, combining the two is more efficient than committing to a single standard.
Do the certifications apply equally to all platforms?
The certifications pertain to the setup, deployment, and operation of secunet public cloud, MetaKube, and secunet Managed Hosting. Separate certifications apply to classified environments (SINA Cloud).
What does “Type 2” mean in the BSI-C5 certification?
A Type 2 attestation not only verifies the design of the controls as of a specific date, but also their effectiveness over a defined audit period. That is why secunet cloud can provide verifiable and auditable evidence of operational security over an extended period of time - a Type 1 attestation would not be able to do that.
From Requirements to the Right Certification
We'll show you which certifications are relevant for your request for proposals or compliance process.
