DEV · Procurement, Development and Modification of Information Systems
DEV-15 Exceptions to the Change Management Process
New in C5:2026
Basic criterion
The cloud service provider's change management process implements procedures for managing exceptions, including emergency changes, to ensure related risks are appropriately mitigated.
Supplementary information
This criteria refers mainly to the exception process demanded in SP-03, although all exceptions from the standard procedure for changes are meant here.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources