# COS-07 Documentation of the Network Topology

- Domain: COS – Communication Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/cos-07/

## Basic criterion

### COS-07.01B

The documentation of the logical structure of the network used to provide or operate the cloud service is traceable and up-to-date, in order to avoid administrative errors during live operation and to ensure timely recovery in the event of incidents in accordance with contractual obligations. The documentation shows:

1. How the subnets are allocated;
2. How the network is zoned and segmented;
3. How the network connects with third party and public networks; and
4. How the data flows between different subnets and system components within the network to support the management, monitoring and analysis of the network.

**Supplementary information (on 01B, 02B, 03B):**

The network documentation can follow a hierarchical or grouped approach based on the scale of operations.

**Supplementary information:**

Zoning is a segmentation of the subnets with a firewall implemented at the network perimeters.

### COS-07.02B

The partitions, regions, zones or location in which the cloud service customer data is stored are indicated.

### COS-07.03B

The cloud service provider establishes and maintains an accurate representation of the technical and logical structure of the cloud service provider's systems based on the network topology documentation and the asset inventory (cf. AM-02). The documentation includes the system components that provide security functions and the system components that host the corresponding cloud service customer data and cloud service derived data, or provide sensitive functions.

### COS-07.04B

The network topology documentation is reviewed at least once a year. Timely and appropriate remediation measures address any deviations identified during the review.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Restructured the requirement regarding the content of the content of the documentation as a list.

Extended content of the documentation to include network connections with third party and public networks, and data flows beween subnets and system components.

Specified the geographical location in which cloud service customer data is stoed to be the  partitions, regions, zones or location at which it is stored.

Added requirement regarding the maintenance of a documentation of the technical and logical  structure of the cloud service provider's systems based on the network documentation.

Added requriements regardingt the review of the network topology documentation.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.