# COS-01 Technical Safeguards

- Domain: COS – Communication Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/cos-01/

## Basic criterion

### COS-01.01B

Based on the results of a risk assessment carried out according to OIS-07, the cloud service provider has implemented technical safeguards which are suitable to timely detect and respond to attacks on the network of system components used for provisioning of the cloud service.

### COS-01.02B

For these technical safeguards, preventive and protective measures are implemented at multiple tiers (defence in depth) within the cloud service to mitigate the risk of breaching the deployed defensive system. This includes network-based cyber attacks such as:

1. Attacks on the basis of irregular incoming or outgoing traffic patterns;
2. Distributed Denial-of-Service (DDoS) attacks;
3. Spoofing attacks;
4. Code injection attacks;
5. DNS tunneling; and
6. IoT attacks targeting devices within a network.

**Supplementary information (on 02B, 01AC):**

Technical safeguards that provide protection and prevention at multiple tiers are e.g. a special separation in Identity and Access Management, separate logging for protective systems and Web Application Firewalls (WAFs) for accessing protective systems.

Network-based attacks can be conducted e.g. with MAC spoofing and ARP poisoning attacks. Technical safeguards to prevent unknown physical or virtual devices from joining a physical or virtual network can be based on e.g. MACSec according to IEEE 802.1X:2010.

### COS-01.03B

Data from corresponding technical safeguards implemented (cloud service provider data) is fed into the organisation's SIEM system (cf. OPS-13), so that (counter-) measures regarding correlating events can be initiated. The safeguards are documented, communicated and provided in accordance with SP-01.

## Additional criterion

### COS-01.01AC (additional, complementing)

Technical safeguards ensure that no unknown (physical or virtual) devices join the cloud service provider's (physical or virtual) network.

## Complementary customer criteria

Cloud service customers ensure with suitable controls for parts of the cloud service under their responsibility (e.g. virtual machines within an IaaS solution) that they detect and respond to network-based attacks, based on anomalous inbound and outbound traffic patterns (e.g. MAC spoofing and ARP poisoning attacks) and/or Distributed Denial of Service (DDoS), in a timely manner.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified which data types the criterion applies to.

Added requirement to employ defence in depth.

Extended list of relevant network-based attacks by spoofing attacks, code injection attacks, DNS tunneling and IoT attacks.

Linked criterion to OPS-13, the criterion defining the use of a SIEM.

**Additional criterion:**

Removed specific example from additional criterion.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.