DEV · Procurement, Development and Modification of Information Systems
DEV-10 Approvals for Provision in the Production Environment
Changed since C5:2020 · formerly DEV-09
Basic criterion
No change.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
Authorised personnel or system components of the Cloud Service Provider approve changes to the cloud service based on defined criteria (e.g. test results and required approvals) before these are made available to the cloud customers in the production environment.
Cloud customers are involved in the release according to contractual requirements.
Basic criterion
Authorised personnel or system components of the cloud service provider approve changes to the cloud service based on defined criteria (e.g. test results and required approvals) before these are made available to the cloud service customers in the production environment.
Supplementary information
The definitions for criterion DEV-03 apply.
Cloud service customers are involved in the release according to contractual agreements.
Supplementary information
If the contractual agreements do not foresee customer involvement of the approval, this should be clearly stated in the contractual agreements in order to fulfil this criterion.
Additional criterion
DEV-10.01AC
Additional, complementingThe approval process is monitored. Timely and appropriate remediation measures address any deviations identified during monitoring.
Complementary customer criteria
What cloud service customers implement on their side.
Where changes are to be approved by the cloud service customers in accordance with the contractual agreements before they are made available in the production environment, the cloud service customers ensure with suitable controls that authorised and qualified personnel receives the information made available, assesses the impact on the ISMS framework and decides on the approval in accordance with the conditions specified by the cloud service provider.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources