BSI C5 · Control CRY-02 · Priority: critical · Component: Cryptography & Key Management

What this control covers

Implements strong encryption and authentication for data transmission over public networks, ensuring confidentiality and integrity. Uses state-of-the-art protocols to protect cloud customer data from interception or manipulation during transit.

Why it matters

A defended network limits blast radius after an initial compromise — the difference between an incident and a breach is often the controls described here.

How to implement

AWS

Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.

Azure

Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.

GCP

Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.

Google Workspace

Enable client-side encryption for Drive/Docs and turn on Drive Labels + DLP rules to prevent external sharing of regulated data classes.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Encryption of data for transmission (transport encryption).

Quick checklist

  • Security — Protection / - Configuration
  • Confidentiality — Protection / - Configuration
  • Protection — Protection / - Configuration
  • Data — Protection / - Configuration
  • Authentication — Protection / - Configuration
  • Encryption — Protection / - Configuration

Related articles on this site