# BSI C5 PI-02 — Contractual agreements for the provision of data

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_bsic5_pi02_c80806c72e-bsi-c5-pi-02-contractual-agreements-for-the-provision-of-data
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [BSI C5 (German Cloud)](https://support.icompaas.com/support/solutions/c_gen_bsi_c5) › [Data Processing Interfaces](https://support.icompaas.com/support/solutions/folders/f_gen_cgenbsic5_dataprocessinginterfaces)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

BSI C5 · Control PI-02 · Priority: high · Component: Data Processing Interfaces

### What this control covers

Defines contractual terms for data provision upon termination, specifying type, format, timeframe, and deletion obligations. Aligns with customer needs and legal requirements, ensuring secure and timely data return to cloud customers.

### Why it matters

A well-architected cloud landing zone bakes most of these controls in at the platform layer — done well, individual workloads inherit security for free.

### How to implement

#### AWS

Segment workloads into separate **VPCs/accounts per environment**. Use **security groups** as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and **VPC Flow Logs** to CloudWatch/S3. Front public services with **AWS WAF + Shield Advanced** and use **PrivateLink/VPC Endpoints** to keep service traffic off the internet.

#### Azure

Use **Network Security Groups** and **Application Security Groups** for east-west, and an **Azure Firewall** or NVA in a hub VNet for north-south. Enforce **Private Endpoints** for PaaS and turn on **Defender for Cloud — Network** for adaptive hardening recommendations.

#### GCP

Use **VPC Service Controls** to draw a perimeter around sensitive APIs and a hierarchical **Firewall policy** at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global **Cloud Load Balancer + Cloud Armor**.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Contractual agreements for the provision of data.

### Quick checklist

-   Interfaces — Agreements / - Configuration
-   Security — Agreements / - Configuration
-   Data — Agreements / - Configuration
-   Secure — Agreements / - Configuration
-   Contractual — Agreements / - Configuration
-   Legal — Agreements / - Configuration

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [Ensure that encryption at rest is enabled for Amazon Athena query results stored in Amazon S3 in order to secure data and meet compliance requirements for data-at-rest encryption.](https://support.icompaas.com/support/solutions/articles/62000233406-ensure-that-encryption-at-rest-is-enabled-for-amazon-athena-query-results-stored-in-amazon-s3-in-orde)
-   [Ensure EBS Volumes Attached to an EC2 Instance Are Marked for Deletion Upon Instance Termination](https://support.icompaas.com/support/solutions/articles/62000233975-ensure-ebs-volumes-attached-to-an-ec2-instance-are-marked-for-deletion-upon-instance-termination)
-   [Enable Transparent Data Encryption with Customer-Managed Keys on Azure SQL Servers for Enhanced Data Security](https://support.icompaas.com/support/solutions/articles/62000234802-enable-transparent-data-encryption-with-customer-managed-keys-on-azure-sql-servers-for-enhanced-data-)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.