# DEV-04 Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools

- Domain: DEV – Procurement, Development and Modification of Information Systems
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/dev-04/

## Basic criterion

### DEV-04.01B

The cloud service provider provides a training programme for regular, role-based security training and awareness for internal and external personnel on standards and methods for:

1. Secure software development and provision as well as on how to use the tools used for this purpose; and
2. Risks linked to malicious code and best practices to reduce the impact of an infection.

**Supplementary information:**

This is a specialised criteria for safety training and awareness programmes for a particular target group. In HR-03, general properties of such trainings and programmes are defined.

### DEV-04.02B

The programme is regularly reviewed and updated with regard to the applicable policies and procedures, the assigned roles and responsibilities and the tools used.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified training programme to be role-based rather than target group-oriented.

Added risks linked to malicious code and best practices for reducing the impact of an infection to the content of the training programme.

Restructured criterion as a list for better readability.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.