Who it’s for
Your customers rely on your platform running and their data being safe. So does the legislator: cloud services, data centres and content delivery networks count as digital infrastructure under NIS2, the Data Act governs switching between cloud services, and financial customers bring DORA into your contracts. Complass brings these obligations together in one account.
When a data centre or cloud region fails, many companies come to a standstill at once. This is why strict requirements on operations, contingency planning and reporting apply to digital infrastructure.
Certificates, audit reports, data processing agreements and questionnaires: every larger customer wants to see how you protect their data.
The Data Act requires that customers can take their data and applications to another provider. This affects contracts, technology and processes.
Providers of cloud computing services, data centre services and content delivery networks are listed in Annex 1 of the German BSI Act. Many of them are essential entities because of their size or because they operate critical facilities.
Not sure which frameworks apply to you? Start the applicability check
Costs, effort and time: consultant only, consultant with Complass or in-house with Complass? Open the compliance cost calculator
BSI C5. Some customers additionally expect an attestation against the BSI’s C5 catalogue (Cloud Computing Compliance Criteria Catalogue), for example in healthcare. Complass does not include a C5 framework of its own.
General information, not legal advice. This page summarises the legal position in simplified form and does not replace an assessment of your individual case. The wording of the laws and standards is authoritative.
IaaS, PaaS and SaaS on your own platform: NIS2, the Data Act and large customers’ expectations of evidence.
Physical security, power and cooling, access control and contingency planning, above the thresholds as a critical facility.
Servers, web hosting and operations for customers; often a managed service provider at the same time.
Entity types of their own in the BSI Act; DNS service providers are essential entities regardless of their size.
One management system for both frameworks, with Statement of Applicability, mandatory documents and action plan.
More about this featureA phase of its own for providers of data processing services, with a template for switching clauses and exit plan.
Assess business processes, set recovery times and maintain contingency plans for outages of sites or services.
More about this featureCheck reporting obligations under NIS2 and the GDPR, track deadlines with a countdown and notify your financial customers with the DORA template.
More about this feature
You can use the frameworks for your sector individually. We are preparing an industry template of its own for service providers to the financial sector.
available
from €179 per month plus VAT in the Start package, size S, annual payment
available
from €179 per month plus VAT in the Start package, size S, annual payment
coming soon
All prices are for businesses, not for consumers. They are net plus VAT with annual payment; monthly payment carries a surcharge of 15 %. As of 16 October 2026. Enterprise and groups of companies on request.
Packages marked “coming soon” or “in preparation” cannot be booked yet. We will state the price and scope once a package can be booked. We are happy to show you the included frameworks and features in a demo already, as far as they are available.
Cloud and data centre services usually fall under NIS2 only from medium size onwards, that is from 50 employees or more than EUR 10 million turnover and balance sheet total. DNS service providers are covered regardless of size. Even below the thresholds your customers often ask for comparable evidence.
Customers must be able to switch to another provider or to their own IT. This includes clear switching clauses in the contract, the export of their data in a common format and information on the switching process. Switching charges are being phased out and no longer apply from 12 January 2027.
No, Complass does not offer a framework of its own for C5. With ISO 27001, NIS2 and business continuity management you document many measures your customers also ask about.
Set up your trial yourself, with a sample project per framework if you like. If you would rather see Complass first, request a demo.
