COS-01 Technical safeguards
Deploy risk-derived technical controls that promptly detect and respond to irregular inbound or outbound traffic patterns and distributed denial of service attacks, feeding their output into a SIEM so correlated events can trigger countermeasures.
Source: BSI C5 (121-criteria catalogue), COS-01. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open BSI C5 (121-criteria catalogue) in the compliance library.
The edition of the catalogue is not stamped here; check the edition your attestation is issued against.
These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.
system holds itEvidence a system already holds
- Risk analysis output that drove selection of the protective measures deployed · Policy repository / GRC workspace
- Denial of service mitigation configuration together with its activation thresholds · Cloud console / configuration management
- Correlation rule set plus one worked alert showing the response taken · SIEM / log platform
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Inventory of network protection sources currently feeding the security event platform · Policy repository / GRC workspace
First move
Common gaps auditors find
- Traffic anomaly sensors installed while their telemetry never reaches the event platform
- Mitigation thresholds left at vendor defaults with no reference to measured traffic baselines
- Detections raised outside office hours with nobody rostered to receive them
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetCOM-04 Information on information security performance and management assessment of the ISMS · COS-02 Security requirements for connections in the Cloud Service Provider's network