DEV · Procurement, Development and Modification of Information Systems
DEV-14 Secure Use of Third Party Hardware and Software
New in C5:2026
Basic criterion
Policies and procedures for the use of third party and open source software are documented, communicated and provided in accordance with SP-01.
Supplementary information
The policy should consider, where applicable, the same aspects as the policy for the proper and secure use of assets (cf. AM-05).
For the hardware and software products (cf. DEV-13) used in the development of the cloud service, a list of dependencies to those products is maintained.
Only trusted sources are used to retrieve third party software. Whenever possible, the authenticity of the software is verified.
Additional criterion
DEV-14.01AC
Additional, complementingIn procurement for the development of the cloud service, the cloud service provider performs a risk assessment in accordance with OIS-07 for every hardware and software product.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources