C5 (Germany)
C5: Procurement, Development and Modification of Information Systems

C5 (Germany) C5-DEV-05: Risk assessment, categorisation and prioritisation of changes

Assess each planned change for its potential effect on the system components involved and assign it a risk category and priority, which then determine how deeply it is tested and what approvals it must carry.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 22 controls across 16 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-218 · 3 controls

FedRAMP High · 2 controls

  • CM-3 Configuration Change Control
  • CM-4 Impact Analyses

FedRAMP Moderate · 2 controls

  • CM-3 Configuration Change Control
  • CM-4 Impact Analyses

NIST SP 800-161 Rev 1 · 2 controls

PCI DSS 4.0 · 2 controls

  • 12.5.3 12.5.3 Scope review after significant organisational change
  • 6.5.2 6.5.2 Confirm PCI DSS controls after significant change

Azure Security Benchmark · 1 control

CIS Controls v8 · 1 control

  • CIS-16.6 Establish and Maintain a Severity Rating System and Process for Application Vulnerabilities

CMMC 2.0 · 1 control

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 1 control

ISO 27001:2022 · 1 control

  • 8.32 Change management

ISO 27002:2022 · 1 control

  • 8.32 Change management

NIS2 Directive · 1 control

  • Art.21.2.e Security in acquisition, development and maintenance, including vulnerability handling and disclosure

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-ID.RA-07 Changes and exceptions are managed, assessed for risk impact, recorded, and tracked

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-53 Rev 5 · 1 control

SOC 2 · 1 control

  • SOC2-CC3.4 CC3.4 Identifying and assessing significant changes (COSO principle 9)

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in C5: Procurement, Development and Modification of Information Systems

You are reading one control. How much of C5 (Germany) have you already done?

C5 (Germany) C5-DEV-05 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of C5 (Germany) your existing evidence covers. Hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 and 95 of 121 C5 (Germany) controls already carry evidence.

If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.178.5% covered · 26 gapsIf you hold NIST SP 800-53 Rev 572.7% covered · 33 gapsIf you hold FedRAMP Moderate71.1% covered · 35 gapsIf you hold ISO 27002:202267.8% covered · 39 gapsIf you hold ISO 27001:202257% covered · 52 gapsIf you hold NIST SP 800-171 Rev 350.4% covered · 60 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 22 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll C5 (Germany) controls