BSI C5 (German Cloud)

BSI C5 controls in the Operations Security family.

• BSI C5 OPS-06 — Data Protection and Recovery - Concept
• BSI C5 OPS-09 — Data Backup and Recovery - Storage
• BSI C5 OPS-24 — Separation of Datasets in the Cloud Infrastructure
• BSI C5 OPS-01 — Capacity Management - Planning
• BSI C5 OPS-02 — Capacity Management - Monitoring

BSI C5 controls in the Cryptography & Key Management family.

• BSI C5 CRY-02 — Encryption of data for transmission (transport encryption)
• BSI C5 CRY-03 — Encryption of sensitive data for storage
• BSI C5 CRY-01 — Policy for the use of encryption procedures and key management
• BSI C5 CRY-04 — Secure key management

BSI C5 controls in the Asset Management family.

• BSI C5 AM-04 — Decommissioning of Hardware
• BSI C5 AM-01 — Asset Inventory
• BSI C5 AM-02 — Acceptable Use and Safe Handling of Assets Policy

BSI C5 controls in the Data Processing Interfaces family.

• BSI C5 PI-03 — Secure deletion of data
• BSI C5 PI-01 — Documentation and safety of input and output interfaces
• BSI C5 PI-02 — Contractual agreements for the provision of data

BSI C5 controls in the Development & Change Management family.

• BSI C5 DEV-10 — Separation of environments
• BSI C5 DEV-01 — Policies for the development/procurement of information systems
• BSI C5 DEV-02 — Outsourcing of the development

BSI C5 controls in the Identity & Access Management family.

• BSI C5 IDM-07 — Access to cloud customer data
• BSI C5 IDM-01 — Policy for user accounts and access rights
• BSI C5 IDM-02 — Granting and change of user accounts and access rights

BSI C5 controls in the Business Continuity Management family.

• BSI C5 BCM-01 — Top management responsibility
• BSI C5 BCM-02 — Business impact analysis policies and instructions

BSI C5 controls in the Communication & Network Security family.

• BSI C5 COS-01 — Technical safeguards
• BSI C5 COS-02 — Security requirements for connections in the Cloud Service Provider's network

BSI C5 controls in the Compliance Management family.

• BSI C5 COM-01 — Identification of applicable legal, regulatory, self-imposed or contractual requirements
• BSI C5 COM-02 — Policy for planning and conducting audits

BSI C5 controls in the Human Resources Security family.

• BSI C5 HR-01 — Verification of qualification and trustworthiness
• BSI C5 HR-02 — Employment terms and conditions

BSI C5 controls in the Information Security Governance family.

• BSI C5 OIS-01 — Information Security Management System (ISMS)
• BSI C5 OIS-02 — Information Security Policy

BSI C5 controls in the Physical Security family.

• BSI C5 PS-01 — Physical Security and Environmental Control Requirements
• BSI C5 PS-02 — Redundancy model

BSI C5 controls in the Security Incident Management family.

• BSI C5 SIM-01 — Policy for security incident management
• BSI C5 SIM-02 — Processing of security incidents

BSI C5 controls in the Supplier & Service Oversight family.

• BSI C5 SSO-01 — Policies and instructions for controlling and monitoring third parties
• BSI C5 SSO-02 — Risk assessment of service providers and suppliers

BSI C5 controls in the Investigative Cooperation family.

• BSI C5 INQ-04 — Limiting Access to or Disclosure of Data in Investigation Requests

Plain-English overview of the framework.

• BSI C5:2020 — overview

BSI C5 controls in the Platform & Service Security family.

• BSI C5 PSS-12 — Locations of Data Processing and Storage

BSI C5 controls in the Security Policy Management family.

• BSI C5 SP-01 — Documentation, communication and provision of policies and instructions