# COS-05 Networks for Administration

- Domain: COS – Communication Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/cos-05/

## Basic criterion

### COS-05.01B

There are separate networks for the administrative management of the infrastructure and for the operation of management consoles. These networks are logically or physically separated from the cloud service customer's network and protected from unauthorised access by multi-factor authentication (cf. IAM-08).

**Supplementary information:**

The separation can be physical or logical (e.g. VLAN, SDN, VRF).

### COS-05.02B

Networks used by the cloud service provider to create, migrate or orchestrate compute workloads (e.g. virtual machines, containers, functions) are physically or logically separated from tenant networks.

## Additional criterion

### COS-05.01AC (additional, complementing)

If there is no physical separation between the administration networks and other networks, the administration network traffic uses state of the art encryption (cf. CRY-01).

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

No change.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.