DEV · Procurement, Development and Modification of Information Systems
DEV-04 Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools
Changed since C5:2020
Basic criterion
Specified training programme to be role-based rather than target group-oriented.
Added risks linked to malicious code and best practices for reducing the impact of an infection to the content of the training programme.
Restructured criterion as a list for better readability.
Wording in C5:2020
Basic criterion
The Cloud Service Provider provides a training program for regular, target group-oriented security training and awareness for internal and external employees on standards and methods of secure software development and provision as well as on how to use the tools used for this purpose. The program is regularly reviewed and updated with regard to the applicable policies and instructions, the assigned roles and responsibilities and the tools used.
Basic criterion
The cloud service provider provides a training programme for regular, role-based security training and awareness for internal and external personnel on standards and methods for:
- Secure software development and provision as well as on how to use the tools used for this purpose; and
- Risks linked to malicious code and best practices to reduce the impact of an infection.
Supplementary information
This is a specialised criteria for safety training and awareness programmes for a particular target group. In HR-03, general properties of such trainings and programmes are defined.
The programme is regularly reviewed and updated with regard to the applicable policies and procedures, the assigned roles and responsibilities and the tools used.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources