The BSI Criteria Catalogue C5 is a document that has been provided by the Federal Office for Information Security (BSI) in Germany to support customers in selecting, controlling, and monitoring their cloud service providers (CSPs). The C5 stands for Cloud Computing Compliance Criteria Catalogue and specifies minimum requirements for secure cloud computing. The C5 is primarily intended for professional CSPs, their auditors, and customers of the CSPs. The C5 covers 17 domains and 114 control objectives that address all key aspects of cloud security, such as data protection, identity and access management, encryption and key management, incident response, audit assurance, and compliance. The C5 also maps to other industry-accepted security standards, regulations, and frameworks, such as ISO 27001/27002/27017/27018, NIST SP 800-53, CSA Cloud Controls Matrix (CCM), COBIT, GDPR, etc. The C5 helps customers to evaluate and compare the security and compliance posture of different CSPs, and to verify that the CSPs meet their contractual obligations and legal requirements12.
Reference:
BSI - C5 criteria catalogue - Federal Office for Information Security
Germany C5 - Azure Compliance | Microsoft Learn

Supply chain agreements between a cloud service provider and cloud customers should, at a minimum, include audits, assessments, and independent verification of compliance certifications with agreement terms. This is because cloud services involve multiple parties in the supply chain, such as cloud providers, sub-providers, brokers, carriers, and auditors. Each party may have different roles and responsibilities in delivering the cloud services and ensuring their quality, security, and compliance. Therefore, it is important for the cloud customers to have visibility and assurance of the performance and compliance of the cloud providers and their sub-providers. Audits, assessments, and independent verification of compliance certifications are methods to evaluate the effectiveness of the controls and processes implemented by the cloud providers and their sub-providers to meet the agreement terms. These methods can help the cloud customers to identify any gaps or risks in the supply chain and to take corrective actions if needed. This is part of the Cloud Control Matrix (CCM) domain COM-04: Audit Assurance & Compliance, which states that "The organization should have a policy and procedures to conduct audits and assessments of cloud services and data to verify compliance with applicable regulatory frameworks, contractual obligations, and industry standards."12 Reference := CCAK Study Guide, Chapter 3: Cloud Compliance Program, page 551; Practical Guide to Cloud Service Agreements Version 2.02