Domains

DEV

Procurement, Development and Modification of Information Systems

15 criteria, 32 basic and 10 additional sub-criteria

• DEV-01Policies for the Development/Procurement of System Components4 sub-criteria: 3 basic, 1 additional
• DEV-02Outsourcing of the Development4 sub-criteria: 2 basic, 2 additional
• DEV-03Policies for Changes to System Components1 sub-criterion
• DEV-04Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools2 sub-criteria
• DEV-05Design Documentation for Security Features1 sub-criterion, new in C5:2026
• DEV-06Risk Assessment, Categorisation and Prioritisation of Changes3 sub-criteria: 2 basic, 1 additional
• DEV-07Testing Changes6 sub-criteria: 5 basic, 1 additional, with customer criteria
• DEV-08Logging of Changes3 sub-criteria: 2 basic, 1 additional
• DEV-09Version Control5 sub-criteria: 3 basic, 2 additional
• DEV-10Approvals for Provision in the Production Environment3 sub-criteria: 2 basic, 1 additional, with customer criteria
• DEV-11Protection of Development and Test Environments1 sub-criterion, new in C5:2026
• DEV-12Separation of Environments2 sub-criteria
• DEV-13Transparency about Software Components2 sub-criteria, new in C5:2026
• DEV-14Secure Use of Third Party Hardware and Software4 sub-criteria: 3 basic, 1 additional, new in C5:2026
• DEV-15Exceptions to the Change Management Process1 sub-criterion, new in C5:2026

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources