COS-04 Cross-Network Access
Unchanged since C5:2020
Basic criterion
Each network perimeter is controlled by security gateways.
The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.
Supplementary information
A security gateway is a stack of chained filtering and firewall components that restrict communication to explicitly permitted traffic. Security gateways can, for example, employ a P-A-P structure, consisting of an outer packet filter, an application-level gateway acting as a deep-inspection proxy, and an inner packet filter. The stack may be further enriched with an intrusion detection system, intrusion prevention system, or antivirus scanner. However, this structure is not mandatory. It serves to keep filtering and inspection functionally independent of each other, so that a failure of one does not automatically lead to a failure of the other.
Supplementary information
Cross-network access is access from one network to another network via a defined network perimeter.
Additional criterion
COS-04.01AS
Additional, sharpens01BEach network perimeter is controlled by redundant and highly available security gateways.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that access is controlled according to their protection needs by security gateways on the perimeters of the virtual networks within the cloud service for which they are responsible.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources