Press Release

• HLB Stückmann has successfully audited Arvato Systems' Virtual Private Cloud (VPC) in accordance with the requirements catalog of the German Federal Office for Information Security (BSI C5).
• The audit was conducted directly on the Type 2 assurance, which confirms the operational effectiveness of the security measures.
• The issuance of C5 Type 2 attestations has already been completed for AWS and Microsoft Azure cloud solutions, in addition to those for VPC. The Type 2 audit for Google Cloud will be completed by the end of 2025.
   

Gütersloh - Gütersloh – Following an audit by HLB Stückmann, Arvato Systems has passed the C5 attestation (Type 2) for its own Virtual Private Cloud (VPC). The Virtual Private Cloud is part of Avvia, Arvato Systems' service portfolio for high-performance, enterprise-wide managed cloud IT. With the C5 certification, Arvato Systems meets the strict requirements of the German Federal Office for Information Security (BSI) and emphasizes its leading role in cloud security and compliance. At the same time, the successful audit underscores the company's ability to act as a reliable provider for highly regulated industries such as finance, healthcare, and the public sector.

The C5 certificate (Cloud Computing Compliance Controls Catalogue) is an audit standard for cloud services developed by the German Federal Office for Information Security (BSI). It confirms that a cloud provider meets defined security requirements, including aspects such as data protection, information security, and transparency. The attestation was carried out by independent auditors in accordance with the IDW auditing standard "IT auditing outside the financial statement audit (IDW PS 860) and the new version of the IDW auditing note: The auditing of cloud services (IDW PH 9.860.3 n.F.)." The C5 certification provides companies with reliable guidance in selecting secure cloud services.

In addition to issuing the C5 certificate for its own virtual private cloud, Arvato Systems - also audited by HLB Stückmann - has already received Type 2 certificates for its own cloud solutions with its strategic partners Amazon Web Services (AWS) and Microsoft Azure. The C5 attestation of strategic partner Google Cloud will be completed in the fourth quarter of 2025.

“The successful C5 attestation for our Virtual Private Cloud is a significant milestone — not only for Arvato Systems, but also for our customers in highly regulated industries such as finance and healthcare. It confirms that our security measures are not only appropriately designed and implemented, but also effective in operation over time,” says Jörg Schultze-Lutter, Cloud Compliance Manager at Arvato Systems.

Direct route to Type 2 testing

Based on the experience gained during the C5 attestation for Amazon Web Services and Microsoft Azure, Arvato Systems deliberately decided to conduct a Type 2 effectiveness test for the Virtual Private Cloud – without taking the usual first intermediate step of a Type 1 attestation. This decision demonstrates a high degree of maturity and confidence in the company's own processes and systems, which was confirmed by the auditors.

"Together with Arvato Systems, we have shown that Virtual Private Cloud security is not a promise, but a verifiable result – confirmed by the successful C5 certification. Conducting a Type 2 attestation in full compliance with all BSI C5 basic and additional criteria within a tight schedule was ambitious – which makes the result all the more impressive. Arvato Systems has shown that a high security standard can be achieved even under complex conditions," said André Schneider, IT Compliance Auditor at HLB Stückmann.

Continuous improvement of the Arvato Systems Virtual Private Cloud

Although the C5 attestation already confirms that all necessary security requirements for cloud computing have been met, Arvato Systems will use the findings from the C5 attestation to further strengthen and continuously improve the security and compliance standards of the Virtual Private Cloud (VPC).