SOC 2, ISO 27001, C5: Which proof counts for hospitals and public administration?

What is SOC 2?

SOC 2 stands for “System and Organization Controls 2”. The standard was set by the US accounting body AICPA. An auditor checks whether a service provider has put controls in place under the “Trust Services Criteria”: security always, plus availability, processing integrity, confidentiality and privacy as chosen.

• Type I: The controls are described and suitable at a given date.
• Type II: The controls worked over a period, usually six to twelve months.

The result is a report, not a certificate. It is usually shared only under a non-disclosure agreement, and there is no public register. A “SOC 2” badge on a website therefore says little: what matters is the report itself, its period, the criteria audited and the exceptions the auditor found.

Does any law in Germany or the EU require SOC 2?

No. Neither the GDPR nor NIS2, the German BSI Act or the AI Act mention SOC 2. Nor is SOC 2 a certification under Art. 42 GDPR.

For health data in the cloud, the situation is clear. § 393 SGB V requires the cloud service to hold a current C5 attestation; since 1 July 2025 this must be a Type 2 attestation. As a transition, the C5 Equivalence Ordinance accepts three other proofs, each only together with an action plan leading to the C5 attestation:

• ISO/IEC 27001
• ISO 27001 based on IT-Grundschutz
• Cloud Controls Matrix 4.0

SOC 2 is not on this list. A SOC 2 report on its own does not meet § 393 SGB V.

Which proof counts, then?

Proof	Issued by	What it is	What is audited	Weight in Germany
ISO/IEC 27001	ISO, international	Certificate from an accredited body	The organisation’s information security management system	Usual proof; with an action plan, a transition under § 393 SGB V
BSI C5	German Federal Office for Information Security	Attestation by an auditor, Type 1 or Type 2	Security of a cloud service	Required by § 393 SGB V for health data in the cloud
SOC 2	AICPA, USA	Audit report by an auditor, Type I or Type II	Controls of a service provider	Not a required proof

The contracts count as well: the data processing agreement under Art. 28 GDPR and, for professionals bound by secrecy, an agreement under § 203 StGB. No certificate replaces them.

Is SOC 2 worthless, then?

No. SOC 2 Type II is a serious audit by independent auditors, and its controls overlap widely with ISO 27001 and C5. Auditors often combine a C5 audit with a SOC 2 audit. Your data protection officer can use a SOC 2 report as one piece of evidence for the provider’s technical and organisational measures under Art. 32 GDPR.

But the report does not answer the questions that decide the matter for patient, citizen and social data:

• Where is the data processed? SOC 2 does not set a location.
• Does the US CLOUD Act apply? That depends on where the provider and its sub-processors are based, not on the audit report.
• Is there a data processing agreement and an agreement under § 203 StGB? The contracts settle that.
• Does the provider train on your data? That too is in the contract, not in the report.

How do you assess a provider that advertises SOC 2?

1. Ask for the ISO 27001 certificate with its scope, and for the status of the C5 attestation if health data goes to the cloud.
2. Ask to see the SOC 2 report itself, not just the badge: type, period, criteria audited, exceptions.
3. Clarify data location, sub-processors and where they are based.
4. Check the data processing agreement and the agreement under § 203 StGB.

Which proof does basebox have?

basebox GmbH is certified to ISO 27001. For the cloud, the BSI C5 Type 1 attestation is in progress, followed by Type 2. For the server at your site, C5 is not needed; your own requirements apply there. The data processing agreement and the agreement under § 203 StGB can be downloaded under Contract and annexes. basebox does not have a SOC 2 report. You will find the details under Security and in the answers for your security review.