BSI C5:2020 – Control Mapping

This page shows which Wombat controls cover which requirements of BSI C5:2020.

Framework Control	Requirement	Wombat Controls	Severity	Pillar	Category
AM-04 – Data classification and handling	AM-04 – Data classification and handling	WAF-SEC-130 · WAF-SOV-010	🟠	Security, Sovereign Cloud	identity-access
BCM-01 – Business continuity	BCM-01 – Business continuity	WAF-SOV-030	🟠	Sovereign Cloud	logging-monitoring
BCM-02 – Business continuity	BCM-02 – Business continuity	WAF-SEC-100	🟡	Security	identity-access
BCM-02 – Incident management	BCM-02 – Incident management	WAF-SOV-070	🟠	Sovereign Cloud	identity-access
BCM-04 Configuration Management	BCM-04 Configuration Management	WAF-OPS-090	🟠	Operational Excellence	logging-monitoring
COM-01 – Communications security	COM-01 – Communications security	WAF-SEC-040	🟠	Security	identity-access
COM-01 – Network architecture and segmentation	COM-01 – Network architecture and segmentation	WAF-SEC-050	🟠	Security	network-security
COM-01 – Network segmentation	COM-01 – Network segmentation	WAF-SEC-120	🟠	Security	identity-access
COM-02 – Network access controls	COM-02 – Network access controls	WAF-SEC-050	🟠	Security	network-security
CRY-01 – Cryptography policy	CRY-01 – Cryptography policy	WAF-SOV-050 · WAF-SOV-110	🔴	Sovereign Cloud	encryption-key-management
CRY-01 – Use of cryptography	CRY-01 – Use of cryptography	WAF-SEC-030 · WAF-SEC-040 · WAF-SEC-060	🔴 🟠	Security	identity-access
CRY-02 – Key management	CRY-02 – Key management	WAF-SEC-030 · WAF-SOV-050 · WAF-SOV-110	🔴 🟠	Security, Sovereign Cloud	encryption-key-management, identity-access
CRY-03 – Encryption of stored data	CRY-03 – Encryption of stored data	WAF-SEC-030 · WAF-SEC-130	🟠	Security	identity-access
CRY-04 – Encryption of data in transit	CRY-04 – Encryption of data in transit	WAF-SEC-040	🟠	Security	identity-access
DEV-04 – Secure development – supply chain	DEV-04 – Secure development – supply chain	WAF-SEC-110	🟠	Security	container-security
DEV-04 – Secure development – vulnerability handling	DEV-04 – Secure development – vulnerability handling	WAF-SEC-070	🟡	Security	container-security
GOV-04 – Compliance monitoring and reporting	GOV-04 – Compliance monitoring and reporting	WAF-SEC-090	🟡	Security	identity-access
IAM-01 – Identity and access management	IAM-01 – Identity and access management	WAF-SOV-060	🔴	Sovereign Cloud	identity-access
IAM-03 – Privileged access management	IAM-03 – Privileged access management	WAF-SOV-060 · WAF-SOV-070	🔴 🟠	Sovereign Cloud	identity-access
IAM-05 – Separation of duties	IAM-05 – Separation of duties	WAF-SOV-060	🔴	Sovereign Cloud	identity-access
IDM-01 – Identity and access management policy	IDM-01 – Identity and access management policy	WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-040 · WAF-AGN-080 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-060	🔴 🟠	Agentic, Security	agentic-governance, identity-access, logging-monitoring
IDM-02 – Authentication of users	IDM-02 – Authentication of users	WAF-AGN-010 · WAF-SEC-010	🔴 🟠	Agentic, Security	identity-access
IDM-03 – Access control and authorisation	IDM-03 – Access control and authorisation	WAF-AGN-020 · WAF-SEC-020	🔴 🟠	Agentic, Security	agentic-governance, identity-access
IDM-04 – Credential management	IDM-04 – Credential management	WAF-SEC-060	🔴	Security	identity-access
IDM-09 – Privileged access management	IDM-09 – Privileged access management	WAF-SEC-020	🔴	Security	identity-access
IDM-09 – Privileged access rights	IDM-09 – Privileged access rights	WAF-SEC-010	🔴	Security	identity-access
INF-01 – Physical location	INF-01 – Physical location	WAF-SOV-020	🔴	Sovereign Cloud	identity-access
INF-03 – Network security	INF-03 – Network security	WAF-SEC-140	🟠	Security	network-security
INF-04 – Communication security	INF-04 – Communication security	WAF-SEC-140	🟠	Security	network-security
INF-07 – Vulnerability management	INF-07 – Vulnerability management	WAF-SEC-150	🟠	Security	container-security
IS-09 – Incident Management	IS-09 – Incident Management	WAF-REL-060	🟠	Reliability	logging-monitoring
LOG-01 – Logging	LOG-01 – Logging	WAF-SOV-040 · WAF-SOV-070	🟠	Sovereign Cloud	identity-access, network-security
LOG-02 – Log protection	LOG-02 – Log protection	WAF-SOV-040	🟠	Sovereign Cloud	network-security
NET-01 – Network security	NET-01 – Network security	WAF-SOV-090	🟠	Sovereign Cloud	identity-access
OIS-10 Protokollierung und Monitoring	OIS-10 Protokollierung und Monitoring	WAF-OPS-030	🟠	Operational Excellence	logging-monitoring
OPS-01 – Operational monitoring	OPS-01 – Operational monitoring	WAF-AGN-030 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100	🟠 🟡 🟢	Agentic	identity-access, logging-monitoring, reliability-design
OPS-02 – Operational control	OPS-02 – Operational control	WAF-AGN-030 · WAF-AGN-050	🟠 🟡	Agentic	logging-monitoring
OPS-02 – Supplier relationships	OPS-02 – Supplier relationships	WAF-SOV-120	🟠	Sovereign Cloud	data-governance
OPS-04 – Data management	OPS-04 – Data management	WAF-SOV-020 · WAF-SOV-030 · WAF-SOV-040 · WAF-SOV-080 · WAF-SOV-090	🔴 🟠 🟡	Sovereign Cloud	identity-access, logging-monitoring, network-security
OPS-05 – Logging and monitoring	OPS-05 – Logging and monitoring	WAF-SEC-160	🟠	Security	logging-monitoring
OPS-06 – Exit management	OPS-06 – Exit management	WAF-SOV-100	🟡	Sovereign Cloud	logging-monitoring
OPS-06 – Operational continuity / Exit management	OPS-06 – Operational continuity / Exit management	WAF-REL-130	🟠	Reliability	backup-recovery
OPS-12 – Hardening of operating systems	OPS-12 – Hardening of operating systems	WAF-SEC-120	🟠	Security	identity-access
OPS-13 – Configuration management	OPS-13 – Configuration management	WAF-SEC-090 · WAF-SEC-120	🟠 🟡	Security	identity-access
OPS-18 – Vulnerability management	OPS-18 – Vulnerability management	WAF-SEC-070	🟡	Security	container-security
OPS-19 – Patch management	OPS-19 – Patch management	WAF-SEC-070	🟡	Security	container-security
PI-02 – Location of data processing	PI-02 – Location of data processing	WAF-SOV-010	🟠	Sovereign Cloud	identity-access
PRO-01 – Portability and interoperability	PRO-01 – Portability and interoperability	WAF-SOV-100	🟡	Sovereign Cloud	logging-monitoring
PSS-01 – Outsourcing and supply chain	PSS-01 – Outsourcing and supply chain	WAF-SEC-110	🟠	Security	container-security
RB-01 – Availability and Redundancy	RB-01 – Availability and Redundancy	WAF-REL-030 · WAF-REL-040	🔴 🟠	Reliability	network-encryption, secret-management
RB-04 – Data Backup and Recovery	RB-04 – Data Backup and Recovery	WAF-REL-040 · WAF-REL-070	🔴 🟠	Reliability	backup-recovery, secret-management
RB-05 – Disaster Recovery	RB-05 – Disaster Recovery	WAF-REL-070	🟠	Reliability	backup-recovery
RB-10 – Logging and monitoring	RB-10 – Logging and monitoring	WAF-SEC-080	🟠	Security	identity-access
RB-11 – Log integrity and retention	RB-11 – Log integrity and retention	WAF-SEC-080	🟠	Security	identity-access
SCA-01 – Supply chain management	SCA-01 – Supply chain management	WAF-SOV-080	🟡	Sovereign Cloud	logging-monitoring
SIM-01 – Security incident management	SIM-01 – Security incident management	WAF-SEC-080 · WAF-SEC-100	🟠 🟡	Security	identity-access
SIM-02 – Intrusion detection	SIM-02 – Intrusion detection	WAF-SOV-090	🟠	Sovereign Cloud	identity-access
SIM-02 – Security information and event management	SIM-02 – Security information and event management	WAF-SEC-100	🟡	Security	identity-access

Framework Control

Requirement

Wombat Controls

Severity

Pillar

Category

AM-04 – Data classification and handling

WAF-SEC-130 · WAF-SOV-010

🟠

Security, Sovereign Cloud

identity-access

BCM-01 – Business continuity

WAF-SOV-030

🟠

Sovereign Cloud

logging-monitoring

BCM-02 – Business continuity

WAF-SEC-100

🟡

Security

identity-access

BCM-02 – Incident management

WAF-SOV-070

🟠

Sovereign Cloud

identity-access

BCM-04 Configuration Management

WAF-OPS-090

🟠

Operational Excellence

logging-monitoring

COM-01 – Communications security

WAF-SEC-040

🟠

Security

identity-access

COM-01 – Network architecture and segmentation

WAF-SEC-050

🟠

Security

network-security

COM-01 – Network segmentation

WAF-SEC-120

🟠

Security

identity-access

COM-02 – Network access controls

WAF-SEC-050

🟠

Security

network-security

CRY-01 – Cryptography policy

WAF-SOV-050 · WAF-SOV-110

🔴

Sovereign Cloud

encryption-key-management

CRY-01 – Use of cryptography

WAF-SEC-030 · WAF-SEC-040 · WAF-SEC-060

🔴 🟠

Security

identity-access

CRY-02 – Key management

WAF-SEC-030 · WAF-SOV-050 · WAF-SOV-110

🔴 🟠

Security, Sovereign Cloud

encryption-key-management, identity-access

CRY-03 – Encryption of stored data

WAF-SEC-030 · WAF-SEC-130

🟠

Security

identity-access

CRY-04 – Encryption of data in transit

WAF-SEC-040

🟠

Security

identity-access

DEV-04 – Secure development – supply chain

WAF-SEC-110

🟠

Security

container-security

DEV-04 – Secure development – vulnerability handling

WAF-SEC-070

🟡

Security

container-security

GOV-04 – Compliance monitoring and reporting

WAF-SEC-090

🟡

Security

identity-access

IAM-01 – Identity and access management

WAF-SOV-060

🔴

Sovereign Cloud

identity-access

IAM-03 – Privileged access management

WAF-SOV-060 · WAF-SOV-070

🔴 🟠

Sovereign Cloud

identity-access

IAM-05 – Separation of duties

WAF-SOV-060

🔴

Sovereign Cloud

identity-access

IDM-01 – Identity and access management policy

WAF-AGN-010 · WAF-AGN-020 · WAF-AGN-040 · WAF-AGN-080 · WAF-SEC-010 · WAF-SEC-020 · WAF-SEC-060

🔴 🟠

Agentic, Security

agentic-governance, identity-access, logging-monitoring

IDM-02 – Authentication of users

WAF-AGN-010 · WAF-SEC-010

🔴 🟠

Agentic, Security

identity-access

IDM-03 – Access control and authorisation

WAF-AGN-020 · WAF-SEC-020

🔴 🟠

Agentic, Security

agentic-governance, identity-access

IDM-04 – Credential management

WAF-SEC-060

🔴

Security

identity-access

IDM-09 – Privileged access management

WAF-SEC-020

🔴

Security

identity-access

IDM-09 – Privileged access rights

WAF-SEC-010

🔴

Security

identity-access

INF-01 – Physical location

WAF-SOV-020

🔴

Sovereign Cloud

identity-access

INF-03 – Network security

WAF-SEC-140

🟠

Security

network-security

INF-04 – Communication security

WAF-SEC-140

🟠

Security

network-security

INF-07 – Vulnerability management

WAF-SEC-150

🟠

Security

container-security

IS-09 – Incident Management

WAF-REL-060

🟠

Reliability

logging-monitoring

LOG-01 – Logging

WAF-SOV-040 · WAF-SOV-070

🟠

Sovereign Cloud

identity-access, network-security

LOG-02 – Log protection

WAF-SOV-040

🟠

Sovereign Cloud

network-security

NET-01 – Network security

WAF-SOV-090

🟠

Sovereign Cloud

identity-access

OIS-10 Protokollierung und Monitoring

WAF-OPS-030

🟠

Operational Excellence

logging-monitoring

OPS-01 – Operational monitoring

WAF-AGN-030 · WAF-AGN-050 · WAF-AGN-060 · WAF-AGN-070 · WAF-AGN-080 · WAF-AGN-090 · WAF-AGN-100

🟠 🟡 🟢

Agentic

identity-access, logging-monitoring, reliability-design

OPS-02 – Operational control

WAF-AGN-030 · WAF-AGN-050

🟠 🟡

Agentic

logging-monitoring

OPS-02 – Supplier relationships

WAF-SOV-120

🟠

Sovereign Cloud

data-governance

OPS-04 – Data management

WAF-SOV-020 · WAF-SOV-030 · WAF-SOV-040 · WAF-SOV-080 · WAF-SOV-090

🔴 🟠 🟡

Sovereign Cloud

identity-access, logging-monitoring, network-security

OPS-05 – Logging and monitoring

WAF-SEC-160

🟠

Security

logging-monitoring

OPS-06 – Exit management

WAF-SOV-100

🟡

Sovereign Cloud

logging-monitoring

OPS-06 – Operational continuity / Exit management

WAF-REL-130

🟠

Reliability

backup-recovery

OPS-12 – Hardening of operating systems

WAF-SEC-120

🟠

Security

identity-access

OPS-13 – Configuration management

WAF-SEC-090 · WAF-SEC-120

🟠 🟡

Security

identity-access

OPS-18 – Vulnerability management

WAF-SEC-070

🟡

Security

container-security

OPS-19 – Patch management

WAF-SEC-070

🟡

Security

container-security

PI-02 – Location of data processing

WAF-SOV-010

🟠

Sovereign Cloud

identity-access

PRO-01 – Portability and interoperability

WAF-SOV-100

🟡

Sovereign Cloud

logging-monitoring

PSS-01 – Outsourcing and supply chain

WAF-SEC-110

🟠

Security

container-security

RB-01 – Availability and Redundancy

WAF-REL-030 · WAF-REL-040

🔴 🟠

Reliability

network-encryption, secret-management

RB-04 – Data Backup and Recovery

WAF-REL-040 · WAF-REL-070

🔴 🟠

Reliability

backup-recovery, secret-management

RB-05 – Disaster Recovery

WAF-REL-070

🟠

Reliability

backup-recovery

RB-10 – Logging and monitoring

WAF-SEC-080

🟠

Security

identity-access

RB-11 – Log integrity and retention

WAF-SEC-080

🟠

Security

identity-access

SCA-01 – Supply chain management

WAF-SOV-080

🟡

Sovereign Cloud

logging-monitoring

SIM-01 – Security incident management

WAF-SEC-080 · WAF-SEC-100

🟠 🟡

Security

identity-access

SIM-02 – Intrusion detection

WAF-SOV-090

🟠

Sovereign Cloud

identity-access

SIM-02 – Security information and event management

WAF-SEC-100

🟡

Security

identity-access

BSI C5:2020 – Control Mapping

See also