COS-07 Documentation of the Network Topology
Changed since C5:2020
Basic criterion
Restructured the requirement regarding the content of the content of the documentation as a list.
Extended content of the documentation to include network connections with third party and public networks, and data flows beween subnets and system components.
Specified the geographical location in which cloud service customer data is stoed to be the partitions, regions, zones or location at which it is stored.
Added requirement regarding the maintenance of a documentation of the technical and logical structure of the cloud service provider's systems based on the network documentation.
Added requriements regardingt the review of the network topology documentation.
Wording in C5:2020
Basic criterion
The documentation of the logical structure of the network used to provision or operate the Cloud Service, is traceable and up-to-date, in order to avoid administrative errors during live operation and to ensure timely recovery in the event of malfunctions in accordance with contractual obligations. The documentation shows how the subnets are allocated and how the network is zoned and segmented. In addition, the geographical locations in which the cloud customers' data is stored are indicated.
Basic criterion
The documentation of the logical structure of the network used to provide or operate the cloud service is traceable and up-to-date, in order to avoid administrative errors during live operation and to ensure timely recovery in the event of incidents in accordance with contractual obligations. The documentation shows:
- How the subnets are allocated;
- How the network is zoned and segmented;
- How the network connects with third party and public networks; and
- How the data flows between different subnets and system components within the network to support the management, monitoring and analysis of the network.
Supplementary information
Supplementary information
Zoning is a segmentation of the subnets with a firewall implemented at the network perimeters.
The partitions, regions, zones or location in which the cloud service customer data is stored are indicated.
The cloud service provider establishes and maintains an accurate representation of the technical and logical structure of the cloud service provider's systems based on the network topology documentation and the asset inventory (cf. AM-02). The documentation includes the system components that provide security functions and the system components that host the corresponding cloud service customer data and cloud service derived data, or provide sensitive functions.
The network topology documentation is reviewed at least once a year. Timely and appropriate remediation measures address any deviations identified during the review.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources