# BSI C5 COS-02 — Security requirements for connections in the Cloud Service Provider's network

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_bsic5_cos02_04ba4801c0-bsi-c5-cos-02-security-requirements-for-connections-in-the-cloud-service-providers-network
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [BSI C5 (German Cloud)](https://support.icompaas.com/support/solutions/c_gen_bsi_c5) › [Communication & Network Security](https://support.icompaas.com/support/solutions/folders/f_gen_cgenbsic5_communicationnetworksecurity)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

BSI C5 · Control COS-02 · Priority: high · Component: Communication & Network Security

### What this control covers

Defines security requirements for network connections, specifying zone separation, permitted protocols, and segregated admin traffic. Ensures logical or physical customer segregation, protecting cloud data confidentiality and integrity within CSP networks.

### Why it matters

Cloud misconfiguration is the leading cause of cloud-related breaches; posture management is how you catch it before someone else does.

### How to implement

#### AWS

Manage all changes in **Terraform/CloudFormation**; enforce SCPs that deny console writes for prod. Use **AWS Config rules** + **conformance packs** (CIS, HIPAA, PCI) to detect drift.

#### Azure

**Azure Policy** + **Blueprints** baseline landing zones; Bicep/Terraform as IaC and **Policy Insights** for drift.

#### GCP

**Org Policy Service** for guardrails and **Config Validator** in CI to pre-check Terraform plans against policy as code (Rego).

### Evidence to collect

-   `vendor_risk_management` — See the iCompaas Evidence library for the canonical source for this evidence type.
-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Security requirements for connections in the Cloud Service Provider's network.

### Quick checklist

-   Segregation — Management
-   Risk — Management
-   Security — Management
-   Confidentiality — Management
-   Physical — Management
-   Data — Management

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [Source Code Supply Chain Security](https://support.icompaas.com/support/solutions/articles/62000225179-source-code-supply-chain-security)
-   [NIST 800-171 3.12.4 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to](https://support.icompaas.com/support/solutions/articles/62000229333-nist-800-171-3-12-4-develop-document-and-periodically-update-system-security-plans-that-describe-sy)
-   [CMMC 2.0 CA.2.157 Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to ot](https://support.icompaas.com/support/solutions/articles/62000229719-cmmc-2-0-ca-2-157-develop-document-and-periodically-update-system-security-plans-that-describe-syst)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.