C5 (Germany)
C5: Procurement, Development and Modification of Information Systems

C5 (Germany) C5-DEV-01: Policies for the development/procurement of information systems

Issue secure development policies covering the whole service lifecycle and grounded in recognised standards, addressing security in requirements, design, implementation, testing and verification, in software deployment including continuous delivery, and in reacting to faults and vulnerabilities during operation.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 41 controls across 19 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27001:2022 · 4 controls

  • 5.8 Information security in project management
  • 8.25 Secure development life cycle
  • 8.26 Application security requirements
  • 8.27 Secure system architecture and engineering principles

NIST SP 800-218 · 4 controls

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

  • CCM-AIS-01 Application and Interface Security Policy and Procedures
  • CCM-AIS-04 Secure Application Design and Development
  • CCM-DSP-07 Data Protection by Design and Default

FedRAMP High · 3 controls

  • SA-1 Policy and Procedures
  • SA-3 System Development Life Cycle
  • SA-8 Security and Privacy Engineering Principles

FedRAMP Moderate · 3 controls

  • SA-1 Policy and Procedures
  • SA-3 System Development Life Cycle
  • SA-8 Security and Privacy Engineering Principles

ISO 27002:2022 · 3 controls

  • 5.8 Information security in project management
  • 8.25 Secure development life cycle
  • 8.27 Secure system architecture and engineering principles

NIST SP 800-161 Rev 1 · 3 controls

NIST SP 800-53 Rev 5 · 3 controls

Azure Security Benchmark · 2 controls

  • ASBv3-GS-10 Define and implement DevOps security strategy
  • DS-6 Enforce security of workload throughout DevOps lifecycle

CIS Controls v8 · 2 controls

  • CIS-16.1 Establish and Maintain a Secure Application Development Process
  • CIS-16.10 Apply Secure Design Principles in Application Architectures

ISO 27701:2019 · 2 controls

  • 6.11.1 Security requirements of information systems
  • 6.11.2 Security in development and support processes

PCI DSS 4.0 · 2 controls

  • 6.1.1 6.1.1 Requirement 6 policies and procedures maintained and communicated
  • 6.2.1 6.2.1 Secure development of bespoke and custom software

AWS Well-Architected Security Pillar · 1 control

  • SEC11-BP02 Automate testing throughout the development and release lifecycle

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-5 Systems Development and Quality Assurance Category

CMMC 2.0 · 1 control

NIS2 Directive · 1 control

  • Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.PS-06 Secure software development practices are integrated, and their performance is monitored throughout the software development life cycle

NIST SP 800-171 Rev 3 · 1 control

  • 03.16.01 Security Engineering Principles

SOC 2 · 1 control

  • SOC2-CC8.1 CC8.1 Managing changes to procedures, software, data and infrastructure

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in C5: Procurement, Development and Modification of Information Systems

You are reading one control. How much of C5 (Germany) have you already done?

C5 (Germany) C5-DEV-01 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of C5 (Germany) your existing evidence covers. Hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 and 95 of 121 C5 (Germany) controls already carry evidence.

If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.178.5% covered · 26 gapsIf you hold NIST SP 800-53 Rev 572.7% covered · 33 gapsIf you hold FedRAMP Moderate71.1% covered · 35 gapsIf you hold ISO 27002:202267.8% covered · 39 gapsIf you hold ISO 27001:202257% covered · 52 gapsIf you hold NIST SP 800-171 Rev 350.4% covered · 60 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 41 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll C5 (Germany) controls