DEV · Procurement, Development and Modification of Information Systems
DEV-02 Outsourcing of the Development
Changed since C5:2020
Basic criterion
Extended requirement for security in software development by the demand that the security level of the external development should be equivalent to that of internal development.
Added requirement to perform a risk assessment before outsourcing of development, as well as aspects to be considered for the risk assessment.
Bullet points are now sorted to ease discussions about specific list items.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the Cloud Service Provider and the outsourced development contractor:
- Security in software development (requirements, design, implementation, tests and verifications) in accordance with recognised standards and methods;
- Acceptance testing of the quality of the services provided in accordance with the agreed functional and non-functional requirements; and
- Providing evidence that sufficient verifications have been carried out to rule out the existence of known vulnerabilities.
Basic criterion
In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the cloud service provider and the service organisation:
- Security in software development (requirements, design, implementation, tests and verifications) in accordance with recognised standards and methods, ensuring a security level equivalent to that of the cloud service provider's internal development;
- Acceptance testing of the quality of the services provided in accordance with the agreed functional and non-functional requirements; and
- Providing evidence that sufficient verifications have been carried out to rule out the existence of known vulnerabilities.
Supplementary information
Also applies to 02B
Outsourced development in the sense of the basic criterion refers to the development of system components used specifically for the cloud service, by a service organisation of the cloud service provider. The development takes place according to the processes of the service organisation.
The risks that may arise and should be taken into account can, but do not have to, include:
- Risks that may result from the service organisation managing source code without adequate controls, including unauthorised modifications, insufficient version control, or inadequate protection against loss or theft of intellectual property;
- Risks that may result from the service organisation granting access to source code to the cloud service provider or to third-party evaluators, including unauthorised disclosure, loss of confidentiality, or inadequate controls governing how such access is managed and restricted;
- Risks that may result from inadequate personnel screening, insufficient background checks, lack of security awareness training, or high staff turnover within the service organisation, including insider threats or uncontrolled loss of sensitive knowledge;
- Risks that may result from granting the service organisation access to internal development, test or preproduction environments, including excessive privileges, insufficient access controls, or inadequate logging and monitoring of such access; and
- Risks that may result from the service organisation subcontracting parts of the service without adequate security controls in place, including insufficient contractual security requirements imposed on subcontractors or lack of transparency regarding the composition of the supply chain.
The purchase of software available on the market as well as the integration of external personnel into the processes of the cloud service provider do not constitute outsourcing in the sense of this basic criterion.
Before outsourcing the development of the cloud service or components thereof, the cloud service provider conducts a risk assessment according to SSO-02 that takes into account at least the following aspects:
- Management of source code by the service organisation;
- Accessability of source code to the cloud service provider;
- Human resource procedures implemented by the service organisation;
- Required access to the development, test and preproduction environments of the cloud service provider; and
- Management of subcontractors engaged by the service organisation.
Supplementary information
Also applies to 01B
Outsourced development in the sense of the basic criterion refers to the development of system components used specifically for the cloud service, by a service organisation of the cloud service provider. The development takes place according to the processes of the service organisation.
The risks that may arise and should be taken into account can, but do not have to, include:
- Risks that may result from the service organisation managing source code without adequate controls, including unauthorised modifications, insufficient version control, or inadequate protection against loss or theft of intellectual property;
- Risks that may result from the service organisation granting access to source code to the cloud service provider or to third-party evaluators, including unauthorised disclosure, loss of confidentiality, or inadequate controls governing how such access is managed and restricted;
- Risks that may result from inadequate personnel screening, insufficient background checks, lack of security awareness training, or high staff turnover within the service organisation, including insider threats or uncontrolled loss of sensitive knowledge;
- Risks that may result from granting the service organisation access to internal development, test or preproduction environments, including excessive privileges, insufficient access controls, or inadequate logging and monitoring of such access; and
- Risks that may result from the service organisation subcontracting parts of the service without adequate security controls in place, including insufficient contractual security requirements imposed on subcontractors or lack of transparency regarding the composition of the supply chain.
The purchase of software available on the market as well as the integration of external personnel into the processes of the cloud service provider do not constitute outsourcing in the sense of this basic criterion.
Additional criterion
DEV-02.01AC
Additional, complementingThe cloud service provider documents and implements a procedure that enables the supervision and control of the outsourced development activity to ensure that it complies with the secure development policy of the cloud service provider, and that the security level achieved through it matches the security level achieved through internal development.
DEV-02.02AC
Additional, complementingWhen a change contains work from outsourced development, the cloud service provider's personnel runs the tests needed to decide whether the change can be deployed.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources