COS-01 Technical Safeguards
Changed since C5:2020
Basic criterion
Specified which data types the criterion applies to.
Added requirement to employ defence in depth.
Extended list of relevant network-based attacks by spoofing attacks, code injection attacks, DNS tunneling and IoT attacks.
Linked criterion to OPS-13, the criterion defining the use of a SIEM.
Additional criterion
Removed specific example from additional criterion.
Wording in C5:2020
Basic criterion
Based on the results of a risk analysis carried out according to OIS-06, the Cloud Service Provider has implemented technical safeguards which are suitable to promptly detect and respond to network-based attacks on the basis of irregular incoming or outgoing traffic patterns and/or Distributed Denial- of-Service (DDoS) attacks. Data from corresponding technical protection measures implemented is fed into a comprehensive SIEM (Security Information and Event Management) system, so that (counter) measures regarding correlating events can be initiated. The safeguards are documented, communicated and provided in accordance with SP-01.
Additional criterion
Technical measures ensure that no unknown (physical or virtual) devices join the Cloud Service Provider's (physical or virtual) network (e.g. MACSec according to IEEE 802.1X:2010).
Basic criterion
Based on the results of a risk assessment carried out according to OIS-07, the cloud service provider has implemented technical safeguards which are suitable to timely detect and respond to attacks on the network of system components used for provisioning of the cloud service.
For these technical safeguards, preventive and protective measures are implemented at multiple tiers (defence in depth) within the cloud service to mitigate the risk of breaching the deployed defensive system. This includes network-based cyber attacks such as:
- Attacks on the basis of irregular incoming or outgoing traffic patterns;
- Distributed Denial-of-Service (DDoS) attacks;
- Spoofing attacks;
- Code injection attacks;
- DNS tunneling; and
- IoT attacks targeting devices within a network.
Supplementary information
Also applies to 01AC
Technical safeguards that provide protection and prevention at multiple tiers are e.g. a special separation in Identity and Access Management, separate logging for protective systems and Web Application Firewalls (WAFs) for accessing protective systems.
Network-based attacks can be conducted e.g. with MAC spoofing and ARP poisoning attacks. Technical safeguards to prevent unknown physical or virtual devices from joining a physical or virtual network can be based on e.g. MACSec according to IEEE 802.1X:2010.
Data from corresponding technical safeguards implemented (cloud service provider data) is fed into the organisation's SIEM system (cf. OPS-13), so that (counter-) measures regarding correlating events can be initiated. The safeguards are documented, communicated and provided in accordance with SP-01.
Additional criterion
COS-01.01AC
Additional, complementingTechnical safeguards ensure that no unknown (physical or virtual) devices join the cloud service provider's (physical or virtual) network.
Supplementary information
Also applies to 02B
Technical safeguards that provide protection and prevention at multiple tiers are e.g. a special separation in Identity and Access Management, separate logging for protective systems and Web Application Firewalls (WAFs) for accessing protective systems.
Network-based attacks can be conducted e.g. with MAC spoofing and ARP poisoning attacks. Technical safeguards to prevent unknown physical or virtual devices from joining a physical or virtual network can be based on e.g. MACSec according to IEEE 802.1X:2010.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls for parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution) that they detect and respond to network-based attacks, based on anomalous inbound and outbound traffic patterns (e.g. MAC spoofing and ARP poisoning attacks) and/or Distributed Denial of Service (DDoS), in a timely manner.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources