# DEV-09 Version Control

- Domain: DEV – Procurement, Development and Modification of Information Systems
- Since C5:2020: changed (formerly DEV-08)
- Web page: https://c5.patrickscheid.de/en/dev-09/

## Basic criterion

### DEV-09.01B

The cloud service provider uses a version control system that adequately ensures the confidentiality, integrity and authenticity of the source code during all development stages.

### DEV-09.02B

Version control procedures track dependencies of individual changes and attribute each change to individual contributors. The version control procedures are capable of restoring affected system components back to a previous state.

### DEV-09.03B

Version control covers all internally and externally developed software, configurations and third party commercial products under the responsibility of the cloud service provider.

## Additional criterion

### DEV-09.01AC (additional, complementing)

Version control procedures provide appropriate safeguards to ensure that the integrity and availability of cloud service customer data is not compromised when system components are restored back to their previous state.

### DEV-09.02AC (additional, complementing)

The cloud service provider keeps a record of all deployed software versions and system configurations. This record enables the recreation of a previously implemented environment in a test environment.

The retention time for this history is risk-based (cf. OIS-07), defined in the policy for version control and aligned to the support life cycle of the cloud service.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added further specfications about the required configuration of the  version control system.

Added requirement for version control to enable attribution of changes to individual contributors.

Added requirement for version control to ensure integrity and availability of cloud service customer data after restores.

**Additional criterion:**

Added requirements to retain a history of software versions and define ist retention time.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.