BSI C5 · Control DEV-02 · Priority: high · Component: Development & Change Management

What this control covers

Contractually specifies security requirements for outsourced development, including standards compliance, acceptance testing, and vulnerability verification. Ensures third-party deliverables meet CSP security standards, protecting cloud customer data integrity.

Why it matters

Cloud misconfiguration is the leading cause of cloud-related breaches; posture management is how you catch it before someone else does.

How to implement

AWS

Manage all changes in Terraform/CloudFormation; enforce SCPs that deny console writes for prod. Use AWS Config rules + conformance packs (CIS, HIPAA, PCI) to detect drift.

Azure

Azure Policy + Blueprints baseline landing zones; Bicep/Terraform as IaC and Policy Insights for drift.

GCP

Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).

GitHub

Apply branch protection on default and release branches: require PR review, status checks, signed commits, linear history, and dismiss stale reviews on new commits. Use CODEOWNERS for required reviewers, Dependabot + CodeQL for SAST, and the Dependency graph / SBOM export for vendor disclosures.

Evidence to collect

  • vendor_risk_management — See the iCompaas Evidence library for the canonical source for this evidence type.
  • infra_scan — See the iCompaas Evidence library for the canonical source for this evidence type.

Third-party risk management evidence (assessments, contracts, due diligence) shows supplier oversight. Focus: Outsourcing of the development.

Quick checklist

  • Risk — Cloud Customer Data / Development
  • Review — Cloud Customer Data / Development
  • Verification — Cloud Customer Data / Development
  • Security — Cloud Customer Data / Development
  • Data — Cloud Customer Data / Development

Related articles on this site