BSI C3A Audit Status
Why important?
C3A is likely to become the de facto procurement standard; the audit status is the decisive sovereignty credential (German version from Q2/2026).
How measured?
Scale 0–5 + N/A:
- 0 = No reference to C3A / no statement.
- 1 = C3A self-assessment announced.
- 2 = C3A self-assessment documented; C5 met as a prerequisite.
- 3 = C3A criteria partly tested by an independent audit.
- 4 = C3A predominantly tested by an independent audit.
- 5 = C3A fully tested by an independent audit (target sovereignty level reached).
- N/A = no reliable evidence
Sources / Evidence
- No public evidence on file yet.
Validation questions (RFP)
- Is there a BSI C3A audit report, or has an audit been commissioned, and with what timeline? Which services and regions are in scope? Are the results on severability and non-EU dependencies disclosed?
Scores comparison
| Provider | Score | |
|---|---|---|
| AWS European Sovereign Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| IONOS Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| STACKIT | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| OVHcloud Public Cloud (inkl. SecNumCloud) | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| T Cloud Public | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Oracle EU Sovereign Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| pluscloud open | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| UpCloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Exoscale | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Hetzner Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Scaleway | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Delos Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Microsoft Sovereign Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| noris Sovereign Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| SysEleven OpenStack Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Cloud Temple Trusted Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |
| Infomaniak Public Cloud | 0.0 | C3A not yet auditable: German version Q2/2026, audits have not started. Assessment once available. (n/a) |