# DEV-10 Approvals for Provision in the Production Environment

- Domain: DEV – Procurement, Development and Modification of Information Systems
- Since C5:2020: changed (formerly DEV-09)
- Web page: https://c5.patrickscheid.de/en/dev-10/

## Basic criterion

### DEV-10.01B

Authorised personnel or system components of the cloud service provider approve changes to the cloud service based on defined criteria (e.g. test results and required approvals) before these are made available to the cloud service customers in the production environment.

**Supplementary information:**

The definitions for criterion DEV-03 apply.

### DEV-10.02B

Cloud service customers are involved in the release according to contractual agreements.

**Supplementary information:**

If the contractual agreements do not foresee customer involvement of the approval, this should be clearly stated in the contractual agreements in order to fulfil this criterion.

## Additional criterion

### DEV-10.01AC (additional, complementing)

The approval process is monitored. Timely and appropriate remediation measures address any deviations identified during monitoring.

## Complementary customer criteria

Where changes are to be approved by the cloud service customers in accordance with the contractual agreements before they are made available in the production environment, the cloud service customers ensure with suitable controls that authorised and qualified personnel receives the information made available, assesses the impact on the ISMS framework and decides on the approval in accordance with the conditions specified by the cloud service provider.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

No change.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.