[{"data":1,"prerenderedAt":448},["ShallowReactive",2],{"navigation-docs_en":3,"/en/blog/bsi-c3a-microsoft-365-procurement-sovereignty-2026-posts_en":51,"/en/blog/bsi-c3a-microsoft-365-procurement-sovereignty-2026-surround-posts_en":437},[4],{"title":5,"path":6,"stem":7,"children":8,"page":25},"En","/en","en",[9],{"title":10,"path":11,"stem":12,"children":13,"page":25},"Docs","/en/docs","en/1.docs",[14,26],{"title":15,"path":16,"stem":17,"children":18,"icon":25},"Getting Started","/en/docs/getting-started","en/1.docs/1.getting-started/1.index",[19,21],{"title":20,"path":16,"stem":17,"children":-1},"Introduction",{"title":22,"path":23,"stem":24,"children":-1},"Migration Roadmap","/en/docs/getting-started/migration-fahrplan","en/1.docs/1.getting-started/2.migration-fahrplan",false,{"title":27,"path":28,"stem":29,"children":30,"page":25},"Technologies","/en/docs/technologies","en/1.docs/2.technologies",[31,35,39,43,47],{"title":32,"path":33,"stem":34,"children":-1},"Nextcloud","/en/docs/technologies/nextcloud","en/1.docs/2.technologies/1.nextcloud",{"title":36,"path":37,"stem":38,"children":-1},"Matrix / Element","/en/docs/technologies/matrix","en/1.docs/2.technologies/2.matrix",{"title":40,"path":41,"stem":42,"children":-1},"ONLYOFFICE","/en/docs/technologies/onlyoffice","en/1.docs/2.technologies/3.onlyoffice",{"title":44,"path":45,"stem":46,"children":-1},"Ubuntu Linux","/en/docs/technologies/ubuntu","en/1.docs/2.technologies/4.ubuntu",{"title":48,"path":49,"stem":50,"children":-1},"Keycloak","/en/docs/technologies/keycloak","en/1.docs/2.technologies/5.keycloak",{"id":52,"title":53,"authors":54,"badge":60,"body":62,"date":396,"description":397,"extension":398,"faq":399,"howto":409,"image":429,"meta":431,"navigation":432,"path":433,"seo":434,"stem":435,"__hash__":436},"posts_en/en/3.blog/25.bsi-c3a-microsoft-365-procurement-sovereignty-2026.md","How to Spot a Good Cloud Provider – a Simple Checklist",[55],{"name":56,"to":57,"avatar":58},"Michael Wolf","/en/about",{"src":59},"/michael.webp",{"label":61},"Guide",{"type":63,"value":64,"toc":384},"minimark",[65,69,86,91,105,108,112,202,206,213,216,239,243,246,250,276,280,283,354,357,361,364,368,377],[66,67,53],"h1",{"id":68},"how-to-spot-a-good-cloud-provider-a-simple-checklist",[70,71,72,73,77,78,81,82,85],"p",{},"When choosing a cloud service, many people ask the same question: how can I tell whether a provider is a good fit for me? Germany's ",[74,75,76],"strong",{},"Federal Office for Information Security (BSI)"," has published criteria catalogues for this, for example ",[74,79,80],{},"C5"," for information security and ",[74,83,84],{},"C3A"," on the question of how self-determined you can be when using a cloud service. These catalogues are mainly aimed at providers and larger organisations. But you can easily use the ideas behind them for yourself.",[87,88,90],"h2",{"id":89},"briefly-explained-c5-and-c3a","Briefly explained: C5 and C3A",[92,93,94,100],"ul",{},[95,96,97,99],"li",{},[74,98,80],{}," (Cloud Computing Compliance Criteria Catalogue) sets out security requirements for cloud services. Many providers have themselves audited against it.",[95,101,102,104],{},[74,103,84],{}," deals with criteria around sovereignty – for example where data is stored, who can access it and how easy it is to switch.",[70,106,107],{},"As a small business, you don't need to work through these catalogues. The checklist below picks up the most important ideas.",[87,109,111],{"id":110},"the-checklist","The checklist",[113,114,115,128],"table",{},[116,117,118],"thead",{},[119,120,121,125],"tr",{},[122,123,124],"th",{},"Question",[122,126,127],{},"What to look out for",[129,130,131,142,152,162,172,182,192],"tbody",{},[119,132,133,139],{},[134,135,136],"td",{},[74,137,138],{},"Where is my data?",[134,140,141],{},"Country and data centre should be clearly stated",[119,143,144,149],{},[134,145,146],{},[74,147,148],{},"Who else processes it?",[134,150,151],{},"A list of subprocessors should be available",[119,153,154,159],{},[134,155,156],{},[74,157,158],{},"How secure is the service?",[134,160,161],{},"Certificates or attestations, such as ISO 27001 or C5, are a good sign",[119,163,164,169],{},[134,165,166],{},[74,167,168],{},"Are there backups?",[134,170,171],{},"What is backed up, how often, and how does restoring work?",[119,173,174,179],{},[134,175,176],{},[74,177,178],{},"Can I switch?",[134,180,181],{},"Export in open formats, clear notice periods",[119,183,184,189],{},[134,185,186],{},[74,187,188],{},"How do I reach support?",[134,190,191],{},"In your language and time zone?",[119,193,194,199],{},[134,195,196],{},[74,197,198],{},"Is the software open?",[134,200,201],{},"With open source, you can switch providers without switching software",[87,203,205],{"id":204},"why-open-source-scores-here","Why open source scores here",[70,207,208,209,212],{},"One big advantage of open source is ",[74,210,211],{},"freedom of choice",". Nextcloud, Element or Vaultwarden run with lots of different providers – or on your own server. If a provider no longer suits you, you can simply keep running the same software somewhere else. Your data, your habits and your apps stay the same.",[70,214,215],{},"With open source, you also decide for yourself:",[92,217,218,225,232],{},[95,219,220,221,224],{},"which ",[74,222,223],{},"data centre"," the software runs in,",[95,226,227,228,231],{},"how often ",[74,229,230],{},"backups"," are made,",[95,233,234,235,238],{},"who has ",[74,236,237],{},"access"," to the server.",[87,240,242],{"id":241},"for-law-firms-and-practices","For law firms and practices",[70,244,245],{},"Especially if you work with confidential or sensitive data – as a law firm, tax office or practice – it's worth going through the checklist calmly. If you're unsure which requirements apply in your field, it's best to ask your professional chamber, your data protection adviser or a lawyer.",[87,247,249],{"id":248},"a-few-terms-briefly-explained","A few terms, briefly explained",[92,251,252,258,264,270],{},[95,253,254,257],{},[74,255,256],{},"Attestation:"," Confirmation by independent auditors that certain requirements are met.",[95,259,260,263],{},[74,261,262],{},"ISO 27001:"," An international standard for information security management systems.",[95,265,266,269],{},[74,267,268],{},"Subprocessor:"," Other companies a provider uses for its service, for example a data centre.",[95,271,272,275],{},[74,273,274],{},"Data portability:"," The ability to take your data with you in a common format.",[87,277,279],{"id":278},"an-everyday-example","An everyday example",[70,281,282],{},"An occupational therapy practice is looking for a provider for shared file storage. It compares two offers using the checklist:",[113,284,285,297],{},[116,286,287],{},[119,288,289,291,294],{},[122,290,124],{},[122,292,293],{},"Provider A",[122,295,296],{},"Provider B",[129,298,299,310,321,332,343],{},[119,300,301,304,307],{},[134,302,303],{},"Data location",[134,305,306],{},"Germany",[134,308,309],{},"\"EU\" without further detail",[119,311,312,315,318],{},[134,313,314],{},"Subprocessors",[134,316,317],{},"public list",[134,319,320],{},"on request",[119,322,323,326,329],{},[134,324,325],{},"Certificate",[134,327,328],{},"ISO 27001",[134,330,331],{},"none mentioned",[119,333,334,337,340],{},[134,335,336],{},"Export",[134,338,339],{},"WebDAV, normal files",[134,341,342],{},"individual downloads only",[119,344,345,348,351],{},[134,346,347],{},"Support",[134,349,350],{},"German, by phone",[134,352,353],{},"English, by ticket",[70,355,356],{},"Both offers could work. The practice chooses A because it gets all the answers there quickly and clearly. That's exactly the point: the checklist makes the decision easier and easy to explain.",[87,358,360],{"id":359},"tip-keep-the-answers","Tip: keep the answers",[70,362,363],{},"Store the providers' answers together with the contract. That way you have everything to hand when clients ask or when you update your data protection documentation.",[87,365,367],{"id":366},"conclusion","Conclusion",[70,369,370,371,376],{},"A good cloud provider is transparent: it tells you where your data is, who's involved and how you can get out again. With open source, you also keep the freedom to switch at any time. If you'd like support with choosing, have a look at ",[372,373,375],"a",{"href":374},"/en/consulting","Consulting",".",[70,378,379,380,376],{},"If you'd like to give it a try, I'm happy to help – ",[372,381,383],{"href":382},"/en/contact","just drop me a line",{"title":385,"searchDepth":386,"depth":386,"links":387},"",2,[388,389,390,391,392,393,394,395],{"id":89,"depth":386,"text":90},{"id":110,"depth":386,"text":111},{"id":204,"depth":386,"text":205},{"id":241,"depth":386,"text":242},{"id":248,"depth":386,"text":249},{"id":278,"depth":386,"text":279},{"id":359,"depth":386,"text":360},{"id":366,"depth":386,"text":367},"2026-08-18T00:00:00.000Z","Criteria catalogues like the BSI's C5 or C3A help with choosing a cloud. Here's a simple checklist for small businesses, law firms and practices.","md",[400,403,406],{"q":401,"a":402},"What are C5 and C3A?","Both are criteria catalogues from Germany's Federal Office for Information Security (BSI) relating to cloud services. C5 sets out information security requirements for cloud providers. C3A deals with criteria for how independently and self-determined you can use a cloud service.",{"q":404,"a":405},"Do I need a certified provider as a small business?","Not necessarily. Certificates and attestations are a helpful signal, but not a must for every use. What matters is that the provider fits your data and requirements.",{"q":407,"a":408},"What does data portability mean?","That you can export your data at any time in a common format and take it to another provider.",{"name":410,"description":411,"totalTime":412,"steps":413},"Choosing a cloud provider","Five questions to compare cloud offerings in a relaxed way.","P1W",[414,417,420,423,426],{"name":415,"text":416},"Clarify location","Ask in which country and data centre the data is stored.",{"name":418,"text":419},"Read the contract","Look at the data processing agreement and the list of subprocessors.",{"name":421,"text":422},"Check security","Ask about certificates or attestations such as ISO 27001 or C5 and about the backup concept.",{"name":424,"text":425},"Test the export","Try out how easily data can be exported in open formats.",{"name":427,"text":428},"Look at support","Check how to reach support and in which language.",{"src":430},"/img/blog/photo-1454165804606-c3d57bc86b40.webp",{},true,"/en/blog/bsi-c3a-microsoft-365-procurement-sovereignty-2026",{"title":53,"description":397},"en/3.blog/25.bsi-c3a-microsoft-365-procurement-sovereignty-2026","A1dgArERlqgdLNuA2wga-U7Q2ROqtKNOLQO76GsYZOI",[438,443],{"title":439,"path":440,"stem":441,"description":442,"children":-1},"IT Security in Healthcare – What Practices Can Learn from Hospitals","/en/blog/hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","en/3.blog/23.hospital-nis2-microsoft-365-sovereign-cloud-alternative-2026","Hospitals invest a lot in secure IT. The ideas behind it and how small medical practices can benefit too, with open source.",{"title":444,"path":445,"stem":446,"description":447,"children":-1},"Schleswig-Holstein Goes Open Source – What Small Businesses Can Learn","/en/blog/schleswig-holstein-blueprint-libreoffice-migration-states-municipalities-2026","en/3.blog/26.schleswig-holstein-blueprint-libreoffice-migration-states-municipalities-2026","The German state of Schleswig-Holstein is moving its administration to open source step by step. A great example small businesses can learn a lot from.",1792720367437]