C5 requires an ISMS that conforms to ISO 27001 (OIS-01); the additional, more stringent criterion even requires a valid certification. An existing certification covers the core but does not replace any C5 criterion: cloud-specific hardening, tenant isolation, transparency disclosures and customer controls come on top.

Heartland brings both together in a single control system – built once, evidenced many times.

C5:2026 supersedes C5:2020: 168 criteria across 17 domains, plus 6 General Conditions covering legal matters, availability, subservice organizations and data locations. New additions include the Shared Security Responsibility Model, threat intelligence, confidential computing and container management, along with stricter requirements for identities, cryptography and development.

Organizations starting now build directly on C5:2026.

Heartland builds the control system within your existing tool landscape: documentation in SharePoint or Confluence, workflows in Microsoft 365 or Jira – no second data repository and no platform lock-in. From gap analysis through scoping and the system description to alignment with the auditor, one point of contact remains accountable.

Evidence is generated where the work already happens – year after year.

Costs consist of two separate items: the advisory effort for implementation and evidence management, and the auditor’s fee for the Type 1 and Type 2 reports. The advisory effort depends on the service model, the scope and how far your existing ISMS already carries you – the Heartland Approach involves no additional licenses.

In our C5 Readiness Check, we quantify both before you decide.