What this control covers
Defines security requirements for network connections, specifying zone separation, permitted protocols, and segregated admin traffic. Ensures logical or physical customer segregation, protecting cloud data confidentiality and integrity within CSP networks.
Why it matters
Cloud misconfiguration is the leading cause of cloud-related breaches; posture management is how you catch it before someone else does.
How to implement
AWS
Manage all changes in Terraform/CloudFormation; enforce SCPs that deny console writes for prod. Use AWS Config rules + conformance packs (CIS, HIPAA, PCI) to detect drift.
Azure
Azure Policy + Blueprints baseline landing zones; Bicep/Terraform as IaC and Policy Insights for drift.
GCP
Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).
Evidence to collect
vendor_risk_management— See the iCompaas Evidence library for the canonical source for this evidence type.infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Security requirements for connections in the Cloud Service Provider's network.
Quick checklist
- Segregation — Management
- Risk — Management
- Security — Management
- Confidentiality — Management
- Physical — Management
- Data — Management
Related articles on this site
- Microsoft Cloud Security Posture Management (CSPM)
- Source Code Supply Chain Security
- NIST 800-171 3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to
- CMMC 2.0 CA.2.157 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to ot