# COS-02 Security Requirements for Connections in the Cloud Service Provider's Network

- Domain: COS – Communication Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/cos-02/

## Basic criterion

### COS-02.01B

Specific security requirements are designed, documented and provided for establishing connections within the cloud service provider's network. The security requirements define for the cloud service provider's area of responsibility:

1. In which cases the security zones are to be separated and in which cases cloud service customers are to be logically or physically separated;
2. Which communication relationships and which network and application protocols are permitted in each case;
3. How the data traffic for administration and monitoring is separated from each on network level;
4. How office networks are secured with firewalls and secure WIFI configurations as well as VPN for remote access;
5. Which internal, cross-partition communication is permitted; and
6. Which cross-network communication is allowed.

**Supplementary information:**

Cross-partition communication can be realised for e.g. individual regions or locations via e.g. WAN, LAN, VPN, RAS.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Bullet points are now sorted to ease discussions about specific list items.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.