Hosting a public body website on a C5-certified cloud in Berlin: 2026 cost

The verdict in three sentences

For a German public body whose online forms collect personal data, procurement rules and the BSI baseline push towards hosting with a C5 attestation (Cloud Computing Compliance Criteria Catalogue), and the real premium sits at 5 to 10 times the price of a standard cloud setup. The most underestimated line is not the subscription but migration and managed operations, which often make up half of the first-year budget. An IT director who scopes the perimeter carefully (public site, forms, back office) can hold a budget of 25,000 to 80,000 EUR in year one.

What C5 compliance actually changes

The C5 catalogue published by the BSI defines audited requirements on encryption, logging, access management, data location and transparency about jurisdiction. For a public website, not everything needs to sit inside the attested perimeter: static editorial pages can stay on a regular CDN, while forms collecting personal data (grant applications, registrations, citizen files) and their database belong in the compliant zone. In France the equivalent qualification is SecNumCloud, which is stricter on extraterritorial law immunity.

Providers commonly shortlisted in 2026 include IONOS Cloud, STACKIT, Open Telekom Cloud and the German sovereign regions of the large hyperscalers. Public list prices are only indicative: the final figure depends on vCPUs, encrypted storage, external backups and support level.

The full first-year budget

The classic trap is to compare monthly fees only. Migrating an existing site (often an ageing CMS on shared hosting) requires an architecture review, containerisation, a WAF, tested backups and a security acceptance phase.

In following years only hosting, managed services and annual tests remain, usually 19,000 to 70,000 EUR per year. Observed migration timelines run from 6 to 12 weeks, mostly driven by contracting, access rights and acceptance testing rather than the technical transfer.

How to cut the bill without leaving the framework

Three levers work well. First, separate static from sensitive: a statically generated editorial site costs almost nothing to serve, and only the forms API runs on compliant infrastructure. Second, size for real usage: most public body websites get fewer than 50,000 visits a month, so two small virtual machines are enough. Third, pool managed services with other applications of the organisation instead of signing a contract for the website alone.

Mini case study

Julia, IT director of a cultural public foundation in Berlin, runs a 300-page site and four forms (registrations, partnership requests, sponsorship, group bookings). Her current host costs 180 EUR per month. The selected compliant quote: 1,600 EUR per month for hosting, 900 EUR for managed services, 11,000 EUR for migration and 5,000 EUR for a penetration test. Year one: 11,000 + 5,000 + (1,600 + 900) x 12 = 46,000 EUR. By serving the static site through a CDN for 40 EUR per month and keeping only the forms on the compliant cloud, hosting drops to 1,000 EUR per month, saving (1,600 - 1,000 - 40) x 12 = 6,720 EUR per year with no compromise on sensitive data.

FAQ

Is a German public body required to use C5-attested hosting for its website?

There is no blanket legal obligation, but federal guidance and many procurement tenders require a C5 report for cloud services processing personal or sensitive data. A purely editorial site rarely needs it, forms with personal data often do: budget at least 1,000 EUR per month for that perimeter.

How long does a migration to compliant hosting take?

Between 6 and 12 weeks on average. The technical cutover rarely takes more than a week; the rest is contracting, access rights and security acceptance.

Can we keep WordPress, TYPO3 or Drupal on a C5 cloud?

Yes, these CMSs run fine in containers on compliant infrastructure. Plan 2,000 to 4,000 EUR for hardening (updates, WAF, removal of unused plugins) in the migration budget.

Do we need a penetration test before going live?

It is strongly recommended and often required by the data protection officer or CISO. A 3 to 5 day test by a qualified provider costs between 3,000 and 8,000 EUR.

What contract length should we expect with the host?

Most compliant offers are signed for 12 to 36 months, frequently through a framework agreement. A 36-month commitment usually unlocks a 10 to 20 % discount on the monthly fee.

Let's scope your project. Kolonell helps you define what to migrate (site, forms, back office), estimates the year-one budget and proposes a realistic 6 to 12 week cutover plan. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.