COS-07 Documentation of the Network Topology

The documentation of the logical structure of the network used to provide or operate the cloud service is traceable and up-to-date, in order to avoid administrative errors during live operation and to ensure timely recovery in the event of incidents in accordance with contractual obligations. The documentation shows:

1. How the subnets are allocated;

2. How the network is zoned and segmented;

3. How the network connects with third party and public networks; and

4. How the data flows between different subnets and system components within the network to support the management, monitoring and analysis of the network.

Supplementary information

The network documentation can follow a hierarchical or grouped approach based on the scale of operations.

Supplementary information

Zoning is a segmentation of the subnets with a firewall implemented at the network perimeters.

The partitions, regions, zones or location in which the cloud service customer data is stored are indicated.

Supplementary information

The network documentation can follow a hierarchical or grouped approach based on the scale of operations.

The cloud service provider establishes and maintains an accurate representation of the technical and logical structure of the cloud service provider's systems based on the network topology documentation and the asset inventory (cf. AM-02). The documentation includes the system components that provide security functions and the system components that host the corresponding cloud service customer data and cloud service derived data, or provide sensitive functions.

Supplementary information

The network documentation can follow a hierarchical or grouped approach based on the scale of operations.

The network topology documentation is reviewed at least once a year. Timely and appropriate remediation measures address any deviations identified during the review.