DEV · Procurement, Development and Modification of Information Systems
DEV-09 Version Control
Changed since C5:2020 · formerly DEV-08
Basic criterion
Added further specfications about the required configuration of the version control system.
Added requirement for version control to enable attribution of changes to individual contributors.
Added requirement for version control to ensure integrity and availability of cloud service customer data after restores.
Additional criterion
Added requirements to retain a history of software versions and define ist retention time.
Wording in C5:2020
Basic criterion
Version control procedures are set up to track dependencies of individual changes and to restore affected system components back to their previous state as a result of errors or identified vulnerabilities.
Additional criterion
Version control procedures provide appropriate safeguards to ensure that the integrity and availability of cloud customer data is not compromised when system components are restored back to their previous state.
Basic criterion
The cloud service provider uses a version control system that adequately ensures the confidentiality, integrity and authenticity of the source code during all development stages.
Version control procedures track dependencies of individual changes and attribute each change to individual contributors. The version control procedures are capable of restoring affected system components back to a previous state.
Version control covers all internally and externally developed software, configurations and third party commercial products under the responsibility of the cloud service provider.
Additional criterion
DEV-09.01AC
Additional, complementingVersion control procedures provide appropriate safeguards to ensure that the integrity and availability of cloud service customer data is not compromised when system components are restored back to their previous state.
DEV-09.02AC
Additional, complementingThe cloud service provider keeps a record of all deployed software versions and system configurations. This record enables the recreation of a previously implemented environment in a test environment.
The retention time for this history is risk-based (cf. OIS-07), defined in the policy for version control and aligned to the support life cycle of the cloud service.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources