COS-05 Networks for Administration
Changed since C5:2020
Basic criterion
No change.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
There are separate networks for the administrative management of the infrastructure and for the operation of management consoles. These networks are logically or physically separated from the cloud customer's network and protected from unauthorised access by multi-factor authentication (cf. IDM-09). Networks used by the Cloud Service Provider to migrate or create virtual machines are also physically or logically separated from other networks
Basic criterion
There are separate networks for the administrative management of the infrastructure and for the operation of management consoles. These networks are logically or physically separated from the cloud service customer's network and protected from unauthorised access by multi-factor authentication (cf. IAM-08).
Supplementary information
The separation can be physical or logical (e.g. VLAN, SDN, VRF).
Networks used by the cloud service provider to create, migrate or orchestrate compute workloads (e.g. virtual machines, containers, functions) are physically or logically separated from tenant networks.
Additional criterion
COS-05.01AC
Additional, complementingIf there is no physical separation between the administration networks and other networks, the administration network traffic uses state of the art encryption (cf. CRY-01).
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources