C5 requires an ISMS conforming to ISO/IEC 27001 (OIS-01), and the sharpening additional criterion even requires a valid certification. An existing certificate covers the core but replaces no C5 criterion: cloud-specific hardening, tenant separation, transparency information and customer controls come on top.

Heartland brings both together in one control system — built once, evidenced many times.

C5:2026 replaces C5:2020: 168 criteria across 17 areas, plus 6 General Conditions on law, availability, subservice organisations and data locations. New are the Shared Security Responsibility Model, threat intelligence, confidential computing and container management as well as stricter requirements for identities, cryptography and development.

Anyone starting now builds directly on C5:2026.

Heartland builds the control system inside your existing tool landscape: documentation in SharePoint or Confluence, workflows in Microsoft 365 or Jira, no second data set and no platform lock-in. From the gap analysis through scope and system description to the coordination with the auditor, one contact stays responsible.

Evidence is created where the work already happens — year after year.

The cost consists of two separate items: the consulting effort for building the system and producing evidence, and the auditor’s fee for Type 1 and Type 2. The consulting effort depends on the service model, the scope and how far your ISMS already carries — the Heartland Approach adds no additional licences.

In the C5 readiness check we quantify both before you decide.