BSI C5:2020 – Control Mapping
Diese Seite zeigt für BSI C5:2020, welche Wombat Controls welche Anforderungen dieses Rahmenwerks abdecken.
| Framework-Control | Anforderung | Wombat Controls | Schweregrad | Säule | Kategorie |
|---|---|---|---|---|---|
AM-04 – Data classification and handling |
AM-04 – Data classification and handling |
🟠 |
Security, Sovereign Cloud |
identity-access |
|
BCM-01 – Business continuity |
BCM-01 – Business continuity |
🟠 |
Sovereign Cloud |
logging-monitoring |
|
BCM-02 – Business continuity |
BCM-02 – Business continuity |
🟡 |
Security |
identity-access |
|
BCM-02 – Incident management |
BCM-02 – Incident management |
🟠 |
Sovereign Cloud |
identity-access |
|
BCM-04 Configuration Management |
BCM-04 Configuration Management |
🟠 |
Operational Excellence |
logging-monitoring |
|
COM-01 – Communications security |
COM-01 – Communications security |
🟠 |
Security |
identity-access |
|
COM-01 – Network architecture and segmentation |
COM-01 – Network architecture and segmentation |
🟠 |
Security |
network-security |
|
COM-01 – Network segmentation |
COM-01 – Network segmentation |
🟠 |
Security |
identity-access |
|
COM-02 – Network access controls |
COM-02 – Network access controls |
🟠 |
Security |
network-security |
|
CRY-01 – Cryptography policy |
CRY-01 – Cryptography policy |
🔴 |
Sovereign Cloud |
encryption-key-management |
|
CRY-01 – Use of cryptography |
CRY-01 – Use of cryptography |
🔴 🟠 |
Security |
identity-access |
|
CRY-02 – Key management |
CRY-02 – Key management |
🔴 🟠 |
Security, Sovereign Cloud |
encryption-key-management, identity-access |
|
CRY-03 – Encryption of stored data |
CRY-03 – Encryption of stored data |
🟠 |
Security |
identity-access |
|
CRY-04 – Encryption of data in transit |
CRY-04 – Encryption of data in transit |
🟠 |
Security |
identity-access |
|
DEV-04 – Secure development – supply chain |
DEV-04 – Secure development – supply chain |
🟠 |
Security |
container-security |
|
DEV-04 – Secure development – vulnerability handling |
DEV-04 – Secure development – vulnerability handling |
🟡 |
Security |
container-security |
|
GOV-04 – Compliance monitoring and reporting |
GOV-04 – Compliance monitoring and reporting |
🟡 |
Security |
identity-access |
|
IAM-01 – Identity and access management |
IAM-01 – Identity and access management |
🔴 |
Sovereign Cloud |
identity-access |
|
IAM-03 – Privileged access management |
IAM-03 – Privileged access management |
🔴 🟠 |
Sovereign Cloud |
identity-access |
|
IAM-05 – Separation of duties |
IAM-05 – Separation of duties |
🔴 |
Sovereign Cloud |
identity-access |
|
IDM-01 – Identity and access management policy |
IDM-01 – Identity and access management policy |
WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-040 · WAF-AGN-080 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-060 |
🔴 🟠 |
Agentic, Security |
agentic-governance, identity-access, logging-monitoring |
IDM-02 – Authentication of users |
IDM-02 – Authentication of users |
🔴 🟠 |
Agentic, Security |
identity-access |
|
IDM-03 – Access control and authorisation |
IDM-03 – Access control and authorisation |
🔴 🟠 |
Agentic, Security |
agentic-governance, identity-access |
|
IDM-04 – Credential management |
IDM-04 – Credential management |
🔴 |
Security |
identity-access |
|
IDM-09 – Privileged access management |
IDM-09 – Privileged access management |
🔴 |
Security |
identity-access |
|
IDM-09 – Privileged access rights |
IDM-09 – Privileged access rights |
🔴 |
Security |
identity-access |
|
INF-01 – Physical location |
INF-01 – Physical location |
🔴 |
Sovereign Cloud |
identity-access |
|
INF-03 – Network security |
INF-03 – Network security |
🟠 |
Security |
network-security |
|
INF-04 – Communication security |
INF-04 – Communication security |
🟠 |
Security |
network-security |
|
INF-07 – Vulnerability management |
INF-07 – Vulnerability management |
🟠 |
Security |
container-security |
|
IS-09 – Incident Management |
IS-09 – Incident Management |
🟠 |
Reliability |
logging-monitoring |
|
LOG-01 – Logging |
LOG-01 – Logging |
🟠 |
Sovereign Cloud |
identity-access, network-security |
|
LOG-02 – Log protection |
LOG-02 – Log protection |
🟠 |
Sovereign Cloud |
network-security |
|
NET-01 – Network security |
NET-01 – Network security |
🟠 |
Sovereign Cloud |
identity-access |
|
OIS-10 Protokollierung und Monitoring |
OIS-10 Protokollierung und Monitoring |
🟠 |
Operational Excellence |
logging-monitoring |
|
OPS-01 – Operational monitoring |
OPS-01 – Operational monitoring |
WAF-AGN-030 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100 |
🟠 🟡 🟢 |
Agentic |
identity-access, logging-monitoring, reliability-design |
OPS-02 – Operational control |
OPS-02 – Operational control |
🟠 🟡 |
Agentic |
logging-monitoring |
|
OPS-02 – Supplier relationships |
OPS-02 – Supplier relationships |
🟠 |
Sovereign Cloud |
data-governance |
|
OPS-04 – Data management |
OPS-04 – Data management |
WAF-SOV-020 · WAF-SOV-030 · WAF-SOV-040 · WAF-SOV-080 · WAF-SOV-090 |
🔴 🟠 🟡 |
Sovereign Cloud |
identity-access, logging-monitoring, network-security |
OPS-05 – Logging and monitoring |
OPS-05 – Logging and monitoring |
🟠 |
Security |
logging-monitoring |
|
OPS-06 – Exit management |
OPS-06 – Exit management |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
OPS-06 – Operational continuity / Exit management |
OPS-06 – Operational continuity / Exit management |
🟠 |
Reliability |
backup-recovery |
|
OPS-12 – Hardening of operating systems |
OPS-12 – Hardening of operating systems |
🟠 |
Security |
identity-access |
|
OPS-13 – Configuration management |
OPS-13 – Configuration management |
🟠 🟡 |
Security |
identity-access |
|
OPS-18 – Vulnerability management |
OPS-18 – Vulnerability management |
🟡 |
Security |
container-security |
|
OPS-19 – Patch management |
OPS-19 – Patch management |
🟡 |
Security |
container-security |
|
PI-02 – Location of data processing |
PI-02 – Location of data processing |
🟠 |
Sovereign Cloud |
identity-access |
|
PRO-01 – Portability and interoperability |
PRO-01 – Portability and interoperability |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
PSS-01 – Outsourcing and supply chain |
PSS-01 – Outsourcing and supply chain |
🟠 |
Security |
container-security |
|
RB-01 – Availability and Redundancy |
RB-01 – Availability and Redundancy |
🔴 🟠 |
Reliability |
network-encryption, secret-management |
|
RB-04 – Data Backup and Recovery |
RB-04 – Data Backup and Recovery |
🔴 🟠 |
Reliability |
backup-recovery, secret-management |
|
RB-05 – Disaster Recovery |
RB-05 – Disaster Recovery |
🟠 |
Reliability |
backup-recovery |
|
RB-10 – Logging and monitoring |
RB-10 – Logging and monitoring |
🟠 |
Security |
identity-access |
|
RB-11 – Log integrity and retention |
RB-11 – Log integrity and retention |
🟠 |
Security |
identity-access |
|
SCA-01 – Supply chain management |
SCA-01 – Supply chain management |
🟡 |
Sovereign Cloud |
logging-monitoring |
|
SIM-01 – Security incident management |
SIM-01 – Security incident management |
🟠 🟡 |
Security |
identity-access |
|
SIM-02 – Intrusion detection |
SIM-02 – Intrusion detection |
🟠 |
Sovereign Cloud |
identity-access |
|
SIM-02 – Security information and event management |
SIM-02 – Security information and event management |
🟡 |
Security |
identity-access |