# DEV-14 Secure Use of Third Party Hardware and Software

- Domain: DEV – Procurement, Development and Modification of Information Systems
- Since C5:2020: new in C5:2026
- Web page: https://c5.patrickscheid.de/en/dev-14/

## Basic criterion

### DEV-14.01B

Policies and procedures for the use of third party and open source software are documented, communicated and provided in accordance with SP-01.

**Supplementary information:**

The policy should consider, where applicable, the same aspects as the policy for the proper and secure use of assets (cf. AM-05).

### DEV-14.02B

For the hardware and software products (cf. DEV-13) used in the development of the cloud service, a list of dependencies to those products is maintained.

### DEV-14.03B

Only trusted sources are used to retrieve third party software. Whenever possible, the authenticity of the software is verified.

## Additional criterion

### DEV-14.01AC (additional, complementing)

In procurement for the development of the cloud service, the cloud service provider performs a risk assessment in accordance with OIS-07 for every hardware and software product.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.