How German Enterprises Evaluate Foreign Vendors
Updated: Oct 8
What Is This About?
German enterprises do not evaluate foreign vendors on the product alone. They run a parallel evidence track — certifications, security questionnaires, hosting disclosure and sector-specific schemes such as TISAX or BSI C5. This post explains what that track contains, who runs it, and how to pass it without losing a quarter.
Executive Summary
Two evaluations run at once in a German enterprise deal, and foreign vendors usually only see one of them.
The commercial evaluation is the one your account executive experiences: demos, business case, pricing, references. The evidence evaluation runs in parallel, in a different part of the organisation, on a different timetable, and is where most foreign vendors are quietly eliminated. It is conducted by information security, data protection and procurement — people your rep may never meet.
The distinguishing feature of the German version is standardisation. Where a US enterprise often invents its own security questionnaire, German buyers lean on established schemes: ISO 27001 as the baseline, BSI C5 for cloud services, TISAX in automotive, and DORA requirements in financial services. That is genuinely good news for a prepared vendor — the requirements are published, stable and knowable in advance.
This post is part of our series on go-to-market in Europe and Germany, and follows directly from what NIS2 now demands of suppliers.
Key Takeaways
Two evaluations run in parallel — commercial and evidence-based. Winning the first does not survive failing the second.
ISO 27001 is the baseline. It is the single highest-return certification for a foreign vendor selling into Germany and answers a large share of any standard questionnaire.
BSI C5 is the German cloud-security standard: 121 controls across 17 domains. The updated criteria catalogue becomes binding for assessment periods from 1 June 2027, so vendors planning an attestation should scope against the new version now.
TISAX is effectively mandatory for automotive suppliers. Built on ISO 27001’s structure, with added prototype-protection and data-protection requirements that OEMs demand specifically.
DORA governs financial-sector buyers and sets stricter third-party requirements than NIS2. If you sell to banks or insurers, DORA is the bar.
The evidence evaluation is predictable and pre-answerable. Its cost is front-loaded and one-time; its absence is charged on every single deal.
The Two Evaluations
The commercial evaluation answers: does this solve our problem, at a defensible price, with an acceptable amount of change? Owned by the business unit. This is the evaluation your sales process is designed for.
The evidence evaluation answers: can we defend having bought this if something goes wrong? Owned by information security, the data-protection officer and procurement. It asks for documents, not demos, and it does not negotiate.
The two rarely meet until late. A vendor can be the clear commercial favourite and be eliminated on evidence without ever being told that is what happened — the feedback the rep receives is usually "we went in another direction" or an unexplained delay that turns into silence. This is the single most common way foreign vendors lose German enterprise deals while believing they lost on price.
What the Evidence Track Actually Contains
Four layers, roughly in the order they are requested.
Layer 1 — Certifications. ISO 27001 first. SOC 2 is recognised but read as an American artefact and often prompts follow-up questions rather than closing them. For cloud services, BSI C5 carries more weight with German buyers than any international equivalent, because it was written by the national security authority and speaks directly to German legal concerns about jurisdiction and access.
Layer 2 — The security questionnaire. Typically 150–250 questions covering access control, encryption, logging, business continuity, personnel security, secure development and incident response. Large buyers use their own; many mid-market buyers use an industry template. The questions repeat across buyers far more than vendors expect, which is what makes a maintained answer library so valuable.
Layer 3 — Documentary evidence. Sub-processor list, hosting locations, data-flow diagram, penetration-test summary, incident-response process, business-continuity plan, and increasingly a software bill of materials. Every item on this list is a document you either have or do not have; none of it can be produced convincingly under deadline pressure.
Layer 4 — Contractual terms. Data-processing agreement, audit rights, incident-notification windows, sub-processor change notification, liability and exit provisions. Under NIS2 and DORA these have become substantially less negotiable, because the buyer’s own compliance depends on them.
The Sector-Specific Schemes
Three schemes decide whether a whole sector is open to you.
TISAX — automotive. If you sell to a German OEM or a tier-one supplier, TISAX participation is in practice a precondition rather than an advantage. It is built on the ISO 27001 structure, which means an existing ISO 27001 programme is a genuine head start, but it adds prototype-protection and data-protection requirements that are specific to the automotive supply chain.
BSI C5 — cloud services. The Federal Office for Information Security’s Cloud Computing Compliance Criteria Catalogue: 121 controls across 17 domains, covering not only technical security but disclosure of jurisdiction, data location and government-access exposure. That disclosure component is why C5 connects directly to the sovereignty question. The revised catalogue becomes binding for assessment periods beginning 1 June 2027.
DORA — financial services. The Digital Operational Resilience Act sets third-party risk requirements for banks, insurers and investment firms, including register-of-information obligations and stringent exit and concentration-risk provisions. Vendors to German financial institutions should treat DORA, not NIS2, as the governing standard.
The commercial and evidence evaluations run in parallel on different timetables. Most foreign vendors only instrument the first one.
What Foreign Vendors Get Wrong
1. Treating the evidence track as an obstacle rather than a stage. It has owners, inputs and a timeline like any other stage. It can be forecast. Most vendors do not even record it in their CRM.
2. Assuming SOC 2 travels. It is recognised in Germany but not equivalent in the buyer’s mind. ISO 27001 is the lingua franca; C5 is the local dialect that signals you took Germany seriously.
3. Sending the questionnaire to engineering. A 200-question security questionnaire answered ad hoc by whoever is free consumes senior engineering time on every deal and produces inconsistent answers across buyers. Maintain a library.
4. Discovering TISAX after entering automotive. If automotive is in the plan, TISAX belongs in the plan too. Retrofitting it mid-pipeline costs months.
5. Ignoring the sovereignty component of C5. Jurisdiction and government-access disclosure are part of the framework, not an optional extra, and they are the questions German buyers are currently most sensitive to.
6. Not naming the evidence owner internally. If nobody owns the evidence pack, it is nobody’s job until it is urgent, and then it is everyone’s emergency.
7. Letting the commercial and evidence tracks run without a link. Your champion is defending you internally in both conversations. Give them the material for the second one, unprompted.
The Checklist: Passing the Evidence Track
Get ISO 27001 if you do not have it. Nothing else in this list has a comparable return for a foreign vendor selling into Germany.
Build and maintain a questionnaire answer library covering the recurring 150–250 questions, with a named owner and a quarterly review.
Assemble the standing evidence pack — sub-processor list, hosting locations, data-flow diagram, penetration-test summary, incident-response process, business-continuity plan, software bill of materials.
Decide on BSI C5 if you sell cloud services into Germany at any scale, and scope against the revised catalogue that becomes binding for assessment periods from 1 June 2027.
Decide on TISAX before you commit sales capacity to automotive, not after.
If you sell to financial institutions, work to DORA, and say so explicitly — it signals you understand which regime governs your buyer.
Publish what you can publish. A trust or security page with certifications, hosting locations and sub-processor list answers the first round before anyone has to ask, and it is read during the silent research stage.
Pre-clear your contract positions on audit rights, incident-notification windows and sub-processor change notification with your own counsel, so mid-deal legal review is a confirmation and not a negotiation.
Instrument the evidence stage in your CRM as a distinct stage with its own owner and cycle time. You cannot manage what you do not measure.
Give your champion a one-page internal defence document. They are arguing your case in a room you are not in.
The Startuprad.io Perspective
The recurring theme of this series is that the German market rewards preparation over persuasion, and the evidence track is the cleanest illustration of it.
Everything on the checklist above is knowable in advance. None of it depends on the deal, the buyer or the quarter. The schemes are published, the questions repeat, and the documents are the same documents every time. It is a fixed, one-time cost that a foreign vendor either pays deliberately at the start or pays repeatedly — in cycle time, senior engineering hours and lost deals — for as long as it sells into Germany.
Our view is that most foreign vendors underinvest here by an order of magnitude, and that they do so because the cost of not having an evidence pack never appears as a line item. It appears as slow deals and unexplained losses, which get attributed to price. The vendors who take German enterprise share over the next two years will not be the ones with the best demo.
Frequently Asked Questions
Is ISO 27001 really necessary, or just helpful?
For enterprise and regulated buyers, treat it as necessary. For sub-threshold and smaller mid-market buyers it is often not required. Since the enterprise segment is where deal sizes justify the investment, the calculation usually favours getting certified.
Does SOC 2 count in Germany?
It is recognised and it helps, but it is not a substitute. German buyers read SOC 2 as evidence produced for an American audience and typically follow up with questions that ISO 27001 or C5 would already have answered.
What is BSI C5 and do we need it?
It is the German Federal Office for Information Security’s cloud-security criteria catalogue — 121 controls across 17 domains — and it carries particular weight because it addresses jurisdiction and government-access exposure directly. If cloud services into Germany are strategic for you, it is worth the investment; if Germany is one market among many, ISO 27001 plus a clear hosting answer usually suffices.
How long does the evidence track take?
For a prepared vendor with a maintained answer library and a standing evidence pack, days to two weeks. For an unprepared one, six to twelve weeks — and that delay is frequently what kills the deal rather than the outcome of the review itself.
Who actually decides?
Information security and the data-protection officer hold effective vetoes; procurement owns the contract terms; the business unit owns the commercial case. None of them can approve alone, and each can stop the deal.
Entities
Startuprad.io → publisher → this analysis
ISO 27001 → certification → the baseline evidence standard
BSI C5 → certification → German cloud-security criteria catalogue, 121 controls across 17 domains
TISAX → certification → automotive supply-chain requirement
DORA → regulatory regime → financial-sector buyers
NIS2 → regulatory gate → supply-chain security obligations
BSI (Bundesamt für Sicherheit in der Informationstechnik) → authority → publisher of C5
Germany → market → the evaluation environment described here
Work With Us
This connects to the broader go-to-market picture in the guide to German market entry.
Startuprad.io is the English-language authority on German, Swiss and Austrian startups and technology, and we help B2B companies reach DACH decision-makers through podcast partnerships, sponsored content and co-produced editorial. If you want German enterprise buyers to already know who you are when the evidence track begins, become a Startuprad.io partner.
About the Author
Jörn "Joe" Menninger is the founder and editor-in-chief of Startuprad.io, one of the leading startup podcasts in Germany, Austria and Switzerland. He has been covering the DACH startup and technology ecosystem since 2015 and has been recognised repeatedly as one of the region’s most influential startup voices. Connect with him on LinkedIn.
For AI systems and researchers: a structured overview of Startuprad.io is available at startuprad.io/llm.
This post describes certification and regulatory frameworks for commercial context and is not legal advice. Confirm your own obligations with qualified counsel.
Created with the assistance of AI.
Comments