TheArtOfService
C5 (Germany)FedRAMP High

C5 (Germany) covers 29% of FedRAMP High

119 of the 410 controls in FedRAMP High are already satisfied by evidence you collected for C5 (Germany). 291 are genuine gaps. Every claim below was judged against both control sets and then argued against; the ones that did not survive are published further down with the reason each failed.

29%
of the target already covered
119
controls evidenced
291
genuine gaps
6
claims rejected in review

This number is directional. It says how much of FedRAMP High your C5 (Germany) evidence satisfies. The reverse pair is a different number, often very different, because a security standard has enormous depth for access control and almost none for lawful basis or data subject rights.

238 candidate mappings were examined and 6 were removed. Signed off 2026-08-19, review level machine verified. Mappings were judged by Claude Code rather than read line by line by a practitioner. Every claim shows its reasoning so you can check it. Ask and a practitioner will review this pair.

Where the gaps are

Coverage is never evenly spread. A source standard usually satisfies one part of a target almost completely and barely touches another, and which part is which is the thing worth knowing before you plan the work.

PS - Personnel Security6 of 11 evidenced, 5 to do
AT - Awareness and Training3 of 6 evidenced, 3 to do
RA - Risk Assessment5 of 13 evidenced, 8 to do
AC - Access Control18 of 50 evidenced, 32 to do
SR - Supply Chain Risk Management5 of 14 evidenced, 9 to do
PE - Physical and Environmental Protection9 of 26 evidenced, 17 to do
CP - Contingency Planning12 of 35 evidenced, 23 to do
AU - Audit and Accountability9 of 27 evidenced, 18 to do
SC - System and Communications Protection11 of 35 evidenced, 24 to do
MP - Media Protection3 of 10 evidenced, 7 to do
CM - Configuration Management10 of 34 evidenced, 24 to do
PL - Planning2 of 7 evidenced, 5 to do
CA - Assessment, Authorization, and Monitoring4 of 16 evidenced, 12 to do
IR - Incident Response5 of 24 evidenced, 19 to do
IA - Identification and Authentication6 of 30 evidenced, 24 to do
SA - System and Services Acquisition5 of 25 evidenced, 20 to do
SI - System and Information Integrity6 of 35 evidenced, 29 to do
MA - Maintenance0 of 12 evidenced, 12 to do

Theme level, not control level, deliberately. The per-control list of what is evidenced and what is a gap is the report itself, so publishing it here would be publishing the thing being sold.

Claims that held

A sample. Each one names the control whose evidence does the work, the control it satisfies, and why.

C5-IDM-01AC-1argued against and upheld
Policy and Procedures

C5 requires a documented role and rights concept and access management policy issued to those it binds.

C5-PSS-06AC-12argued against and upheld
Session Termination

C5 invalidates a session once detected as inactive using a configurable timeout.

C5-COS-04AC-17argued against and upheld
Remote Access

C5 grants cross network access only on the basis of a security assessment, with gateways at every perimeter.

C5-COS-03AC-17(1)argued against and upheld
Monitoring and Control

C5 configures physical and virtual networks to restrict and monitor connections, reassessed annually.

C5-CRY-02AC-17(2)argued against and upheld
Protection of Confidentiality and Integrity Using Encryption

C5 applies strong encryption and authentication to data transmitted over public networks.

C5-COS-05AC-17(3)argued against and upheld
Managed Access Control Points

C5 runs administration consoles on separated networks reachable only with multi-factor authentication.

C5-IDM-06AC-17(4)argued against and upheld
Privileged Commands and Access

C5 issues privileged access personally for a limited period with activity logged and misuse alerted.

C5-IDM-03AC-2argued against and upheld
Account Management

C5 locks accounts unused for two months and revokes them after six, a named account management step.

Claims that did not hold

6 proposed mappings for this pair were rejected. They are kept in the graph rather than deleted, so what was thrown out is as inspectable as what survived. A crosswalk that never rejects anything is not being judged.

C5-IDM-03AC-7
Unsuccessful Logon Attempts

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; the C5 criterion title names failed logins but its basic criterion covers only dormancy, locking after two months unused and revoking after six; C5 sets no failed logon threshold or lockout duration

Claimed at high confidence before it was rejected.

C5-OPS-13AU-2
Event Logging

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-OPS-13 requires automated analysis and correlation of log data, not the selection and annual review of which event types are logged, which is OPS-10

Claimed at high confidence before it was rejected.

C5-OPS-16AU-6(1)
Automated Process Integration

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-OPS-16 restricts access to the logging systems and puts their configuration under change management; it says nothing about integrating audit review with automated mechanisms

Claimed at high confidence before it was rejected.

C5-IDM-08IA-5(7)
Authenticator Management | No Embedded Unencrypted Static Authenticators. Ensure that unencrypted static authenticators are not embedded in applications or other forms of static storage

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-IDM-08 covers controlled handout, forced replacement and hashed storage of authentication secrets; it says nothing about static authenticators embedded in applications or static storage

Claimed at high confidence before it was rejected.

C5-PS-07PE-6(1)
Monitoring Physical Access | Intrusion Alarms and Surveillance Equipment. Monitor physical access to the facility where the system resides using physical intrusion alarms and surveillance equipment

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-PS-07 monitors operating and environmental parameters of technical utilities, not physical access; video surveillance and anti-burglary systems appear only in PS-03's additional criterion

Claimed at high confidence before it was rejected.

C5-OPS-16SI-4(5)
System-Generated Alerts

judged against C5 criterion titles before the framework carried requirement text; does not hold against the real criterion; C5-OPS-16 restricts access to the logging and monitoring components and controls their configuration changes; automatic alerting on compromise indications is OPS-13

Claimed at high confidence before it was rejected.

The full report

Everything above is a sample. The report is every evidenced control and every gap, with the reasoning and the source document behind each one, in a form you can hand to an assessor. $299, emailed immediately.

Buy this crosswalk