# DEV-11 Protection of Development and Test Environments

- Domain: DEV – Procurement, Development and Modification of Information Systems
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/dev-11/

## Basic criterion

### DEV-11.01B

Development and test environments under the responsibility of the cloud service provider undergo a risk assesssment (cf. OIS-07) and are protected with appropriate security measures against identified risks. This also includes extending the backup plan (cf. OPS-06) to the necessary parts of those environments.

**Supplementary information:**

Note that the backup policies and procedures (cf. OPS-06) are preceded by a risk assessment and does not need to include all elements of those environments, but only the ones considered necessary based on the risk assessment. Some parts can be build from scatch more easily than backing them up.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.