# COS-04 Cross-Network Access

- Domain: COS – Communication Security
- Since C5:2020: unchanged
- Web page: https://c5.patrickscheid.de/en/cos-04/

## Basic criterion

### COS-04.01B

Each network perimeter is controlled by security gateways.

### COS-04.02B

The system access authorisation for cross-network access is based on a security assessment based on the requirements of the cloud service customers.

**Supplementary information:**

A security gateway is a stack of chained filtering and firewall components that restrict communication to explicitly permitted traffic. Security gateways can, for example, employ a P-A-P structure, consisting of an outer packet filter, an application-level gateway acting as a deep-inspection proxy, and an inner packet filter. The stack may be further enriched with an intrusion detection system, intrusion prevention system, or antivirus scanner. However, this structure is not mandatory. It serves to keep filtering and inspection functionally independent of each other, so that a failure of one does not automatically lead to a failure of the other.

**Supplementary information:**

Cross-network access is access from one network to another network via a defined network perimeter.

## Additional criterion

### COS-04.01AS (additional, sharpens 01B)

Each network perimeter is controlled by redundant and highly available security gateways.

## Complementary customer criteria

Cloud service customers ensure with suitable controls that access is controlled according to their protection needs by security gateways on the perimeters of the virtual networks within the cloud service for which they are responsible.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.