An audit is only as good as the evidence you show. A folder of screenshots will not convince a BSI C5 auditor. A signed evidence bundle that can be checked with cryptography will. The SecTepe platform (SecTepe.Comm) builds exactly that: every month, automatically, and with proof of where the data lives.
Signed Evidence Bundles Every Month
Each month the platform creates a Cosign-signed evidence bundle. It stores the bundle in an Object-Lock bucket in COMPLIANCE mode (35 days), so any tampering would show. The process has two steps:
- An export script builds the bundle.
- A verify script checks it with SHA-256 plus keyless Cosign.
So the auditor can see the content and also prove that nobody changed it since it was created.
What Goes Into the Bundle
The contents map directly to C5:2020 criteria. They include, among others:
- C5 and ISO 27001 SoA, risk register, asset inventory and CAPA,
- records of processing activities, DPAs, supplier and sub-processor registers,
- data-residency attestation and internal audit log,
- all 24 written policies and configuration baselines (kube-bench, lynis, trivy, pgaudit),
- SBOM collection, pentest reports and the live state of Kyverno PolicyReports, NetworkPolicies and Velero.
Data-Residency Attestation: Where the Data Really Lives
There is also a written data-residency attestation (C5:2020 BC-01..04, GDPR Art. 44 ff.). It states where the data is stored:
- All platform data lives in Frankfurt (IONOS DC FRA-1).
- Backup replicas live in Berlin (DC BER-1).
- Each row is backed by a configuration file as evidence.
A separate section covers jurisdiction and the CLOUD Act. German law applies. There are no US sub-processors for personal platform data. Optional US providers are used only if the tenant turns them on explicitly. In that case SCCs and a Schrems II TIA secure the transfer.
The Path to the C5 Attestation
The C5 audit scheme (IDW PS 951 / ISAE 3402) starts with a Type 1 attestation. Type 2 follows after six months of evidence from live operation. C5:2020 has 17 areas with 121 base and additional criteria. It adds to ISO 27001:2022 and does not replace it. The same focus on sovereignty and evidence runs through the whole platform. It reaches from supply-chain hardening to the EU-native GRC work in SecTepe.Core.
Conclusion
Signed monthly evidence bundles and a proven data-residency attestation change what BSI C5 audit readiness means. It is no longer a statement of intent but a fact you can check. Many customers have KRITIS, government or sovereignty needs. For them, this is the difference between "we are secure" and "we can prove it".