BSI C5 · Control PS-02 · Priority: high · Component: Physical Security

What this control covers

Provides cloud services from redundant locations meeting PS-01 requirements, ensuring operational continuity per service level agreements. Tests redundancy annually to verify availability, protecting cloud customer data and services from site-specific disruptions.

Why it matters

A well-architected cloud landing zone bakes most of these controls in at the platform layer — done well, individual workloads inherit security for free.

How to implement

AWS

Segment workloads into separate VPCs/accounts per environment. Use security groups as stateful allow-lists (least-port, source by SG ID not 0.0.0.0/0) and VPC Flow Logs to CloudWatch/S3. Front public services with AWS WAF + Shield Advanced and use PrivateLink/VPC Endpoints to keep service traffic off the internet.

Azure

Use Network Security Groups and Application Security Groups for east-west, and an Azure Firewall or NVA in a hub VNet for north-south. Enforce Private Endpoints for PaaS and turn on Defender for Cloud — Network for adaptive hardening recommendations.

GCP

Use VPC Service Controls to draw a perimeter around sensitive APIs and a hierarchical Firewall policy at the org/folder level so projects inherit a deny-by-default posture. Front HTTP workloads with the global Cloud Load Balancer + Cloud Armor.

Evidence to collect

  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Redundancy model.

Quick checklist

  • Security — Agreements / Model
  • Physical — Agreements / Model
  • Redundancy — Agreements / Model
  • Data — Agreements / Model
  • Business — Agreements / Model
  • Locations — Agreements / Model

Related articles on this site