C5 (Germany)
C5: Procurement, Development and Modification of Information Systems

C5 (Germany) DEV-04: Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools

Run a recurring, audience-specific security training and awareness programme for internal and external staff on standards and methods of secure software development and delivery and on the tools involved, and refresh it as policies, roles and tooling change.

What else in your programme already covers this

This control maps to 36 controls across 24 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

NIST SP 800-53 Rev 5 · 3 controls

  • NIST800-AT-3 Role-based training
  • NIST800-SA-15 Development process, standards, and tools
  • NIST800-SA-16 Developer-provided Training. Require the developer of the system, system component, or system service to provide the following training on the correct use and operation of the implemented security and privacy functions, controls, and/or mechanisms:

AWS Well-Architected Security Pillar · 2 controls

  • SEC11-BP01 Train for application security
  • SEC11-BP07 Regularly assess security properties of the pipelines

CIS Controls v8 · 2 controls

  • CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training
  • CIS-16.9 Train Developers in Application Security Concepts and Secure Coding

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 2 controls

  • CCM-AIS-01 Application and Interface Security Policy and Procedures
  • CCM-HRS-12 Personal and Sensitive Data Awareness and Training

FedRAMP High · 2 controls

  • AT-3 Role-Based Training
  • SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the

FedRAMP Moderate · 2 controls

  • AT-3 Role-Based Training
  • SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the

ISO 27001:2022 · 2 controls

  • 6.3 Information security awareness, education and training
  • 8.28 Secure coding

ISO 27002:2022 · 2 controls

  • 6.3 Information security awareness, education and training
  • 8.28 Secure coding

NIST SP 800-53 Rev 5 MODERATE · 2 controls

  • AT-3 Role-Based Training
  • SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the

NIST SP 800-53 Revision 5.1 HIGH · 2 controls

  • AT-3 Role-Based Training
  • SA-15 Development Process, Standards, and Tools. a. Require the developer of the system, system component, or system service to follow a documented development process that: 1. Explicitly addresses security and privacy requirements; 2. Identifies the

PCI DSS 4.0 · 2 controls

  • 6.2.2 Software development personnel working on bespoke and custom software are trained at least once every 12 months as follows: • On software security relevant to their job function and development languages. • Including secure
  • 6.2.4 Coding practices prevent common attacks

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-01 Train Operational Teams in Information System Security

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-5 Systems Development and Quality Assurance Category

CMMC 2.0 · 1 control

DORA · 1 control

HIPAA Security Rule · 1 control

NIS2 Directive · 1 control

  • Art.20.2 Train the management body, and offer equivalent training to staff on a regular basis

NIST Cybersecurity Framework 2.0 · 1 control

  • NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-218 · 1 control

NIST SP 800-53 Rev 5 LOW · 1 control

  • AT-3 Role-Based Training

NIST SP 800-66 Rev 2 · 1 control

SOC 2 · 1 control

  • SOC2-CC1.4 COSO principle 4: Demonstrates commitment to attract and retain competent individuals

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in C5: Procurement, Development and Modification of Information Systems

You are reading one control. How much of C5 (Germany) have you already done?

C5 (Germany) DEV-04 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of C5 (Germany) your existing evidence covers. Hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 and 95 of 121 C5 (Germany) controls already carry evidence.

If you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.178.5% covered · 26 gapsIf you hold NIST SP 800-53 Rev 572.7% covered · 33 gapsIf you hold FedRAMP Moderate71.1% covered · 35 gapsIf you hold ISO 27002:202267.8% covered · 39 gapsIf you hold ISO 27001:202257% covered · 52 gapsIf you hold NIST SP 800-171 Rev 350.4% covered · 60 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 0 were rejected on the Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 36 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll C5 (Germany) controls