# DEV – Procurement, Development and Modification of Information Systems

- Web page: https://c5.patrickscheid.de/en/dev/

- [DEV-01 Policies for the Development/Procurement of System Components](https://c5.patrickscheid.de/en/dev-01/index.html.md): 4 sub-criteria (3 basic, 1 additional), changed since C5:2020
- [DEV-02 Outsourcing of the Development](https://c5.patrickscheid.de/en/dev-02/index.html.md): 4 sub-criteria (2 basic, 2 additional), changed since C5:2020
- [DEV-03 Policies for Changes to System Components](https://c5.patrickscheid.de/en/dev-03/index.html.md): 1 sub-criterion, changed since C5:2020
- [DEV-04 Safety Training and Awareness Programme Regarding Continuous Software Delivery and Associated Systems, Components or Tools](https://c5.patrickscheid.de/en/dev-04/index.html.md): 2 sub-criteria (2 basic), changed since C5:2020
- [DEV-05 Design Documentation for Security Features](https://c5.patrickscheid.de/en/dev-05/index.html.md): 1 sub-criterion, new in C5:2026
- [DEV-06 Risk Assessment, Categorisation and Prioritisation of Changes](https://c5.patrickscheid.de/en/dev-06/index.html.md): 3 sub-criteria (2 basic, 1 additional), changed since C5:2020 (formerly DEV-05)
- [DEV-07 Testing Changes](https://c5.patrickscheid.de/en/dev-07/index.html.md): 6 sub-criteria (5 basic, 1 additional), with customer criteria, changed since C5:2020 (formerly DEV-06)
- [DEV-08 Logging of Changes](https://c5.patrickscheid.de/en/dev-08/index.html.md): 3 sub-criteria (2 basic, 1 additional), changed since C5:2020 (formerly DEV-07)
- [DEV-09 Version Control](https://c5.patrickscheid.de/en/dev-09/index.html.md): 5 sub-criteria (3 basic, 2 additional), changed since C5:2020 (formerly DEV-08)
- [DEV-10 Approvals for Provision in the Production Environment](https://c5.patrickscheid.de/en/dev-10/index.html.md): 3 sub-criteria (2 basic, 1 additional), with customer criteria, changed since C5:2020 (formerly DEV-09)
- [DEV-11 Protection of Development and Test Environments](https://c5.patrickscheid.de/en/dev-11/index.html.md): 1 sub-criterion, new in C5:2026
- [DEV-12 Separation of Environments](https://c5.patrickscheid.de/en/dev-12/index.html.md): 2 sub-criteria (2 basic), changed since C5:2020 (formerly DEV-10)
- [DEV-13 Transparency about Software Components](https://c5.patrickscheid.de/en/dev-13/index.html.md): 2 sub-criteria (2 basic), new in C5:2026
- [DEV-14 Secure Use of Third Party Hardware and Software](https://c5.patrickscheid.de/en/dev-14/index.html.md): 4 sub-criteria (3 basic, 1 additional), new in C5:2026
- [DEV-15 Exceptions to the Change Management Process](https://c5.patrickscheid.de/en/dev-15/index.html.md): 1 sub-criterion, new in C5:2026

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.