+Procurement, Development and Modification of Information Systems (DEV)
---+Policies for the development/procurement of information systems
---+Outsourcing of the development
---+Policies for changes to information systems
---+Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools.
---+Risk assessment, categorisation and prioritisation of changes
---+Testing changes
---+Logging of changes
---+Version Control
---+Approvals for provision in the production environment
---+Separation of environments

Procurement, Development and Modification of Information Systems (DEV)

None

1. Επισκόπηση

Policies for the development/procurement of information systems Policies and instructions with technical and organisational measures for the secure development of the cloud service are documented, communicated and provided in accordance with SP-01.
The policies and instructions contain guidelines for the entire life cycle of the cloud service and are based on recognised standards and methods with regard to the following aspects:
• Security in Software Development (Requirements, Design, Implementation, Testing and Verification);
• Security in software deployment (including continuous delivery); and
• Security in operation (reaction to identified faults and vulnerabilities).
Additonal CriteriaIn procurement, products are preferred which have been certified according to the "Common Criteria for Information Technology Security Evaluation" (short: Common Criteria CC) according Evaluation Assurance Level EAL 4. If noncertified products are to be procured for available certified products, a risk assessment is carried out in accordance with OIS-07.
Supplementary Information - About the CriteriaThe software provision can be carried out e.g. with Continuous Delivery methods.
Accepted standards and methods are, for example:
• ISO/IEC 27034; and
• OWASP Secure Software Development Lifecycle (S-SDLC).
Outsourcing of the development In the case of outsourced development of the cloud service (or individual system components), specifications regarding the following aspects are contractually agreed between the Cloud Service Provider and the outsourced development contractor:
• Security in software development (requirements, design, implementation, tests and verifications) in accordance with recognised standards and methods;
• Acceptance testing of the quality of the services provided in accordance with the agreed functional and non-functional requirements; and
• Providing evidence that sufficient verifications have been carried out to rule out the existence of known vulnerabilities.
Additonal Criteria-
Supplementary Information - About the CriteriaOutsourced development in the sense of the basic criterion refers to the development of system components used specifically for the cloud service by a contractor of the Cloud Service Provider. The development takes place according to the processes of the contractor.
The purchase of software available on the market as well as the integration of external employees into the processes of the Cloud Service Provider do not constitute outsourcing in the sense of this basic criterion.
Policies for changes to information systems Policies and instructions with technical and organisational safeguards for change management of system components of the cloud service within the scope of software deployment are documented, communicated and provided according to SP-01 with regard to the following aspects:
• Criteria for risk assessment, categorisation and prioritisation of changes and related requirements for the type and scope of testing to be performed, and necessary approvals for the development/implementation of the change and releases for deployment in the production environment by authorised personnel or system components;
• Requirements for the performance and documentation of tests;
• Requirements for segregation of duties during development, testing and release of changes;
• Requirements for the proper information of cloud customers about the type and scope of the change as well as the resulting obligations to cooperate in accordance with the contractual agreements;
• Requirements for the documentation of changes in system, operational and user documentation; and
• Requirements for the implementation and documentation of emergency changes that must comply with the same level of security as normal changes.
Additonal Criteria-
Supplementary Information - About the CriteriaChanges in the sense of the basic criterion are those that can lead to changes in the configuration, functionality or security of system components of the cloud service in the production environment. This includes changes to the infrastructure as well as to the source code.
If individual changes are combined in a new release, update, patch or comparable software object for the purpose of software provisioning, this software object is deemed to be a change within the meaning of the basic criterion, but not the individual changes contained therein.
Changes to the existing network configuration must also undergo a specified procedure, as they are necessary for effective segregation of cloud customers.
Personnel and system components receive authorisation to approve changes in accordance with the requirements for access and access authorisations (cf. IDM01) via a specified procedure (cf. IDM02).Relevant information includes descriptions of e.g. new functions.
The cloud customer's obligations to cooperate can define that, e.g. the cloud customer must carry out certain tests.
Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools. The Cloud Service Provider provides a training program for regular, target group-oriented security training and awareness for internal and external employees on standards and methods of secure software development and provision as well as on how to use the tools used for this purpose. The program is regularly reviewed and updated with regard to the applicable policies and instructions, the assigned roles and responsibilities and the tools used.
Additonal Criteria-
Supplementary Information - About the Criteria-
Risk assessment, categorisation and prioritisation of changes In accordance with the applicable policies (cf. DEV-03), changes are subjected to a risk assessment with regard to potential effects on the system components concerned and are categorised and prioritised accordingly.
Additonal CriteriaIn accordance with the contractual agreements, meaningful information about the occasion, time, duration, type and scope of the change is submitted to authorised bodies of the cloud customer so that they can carry out their own risk assessment before the change is made available in the production environment. Regardless of the contractual agreements, this is done for changes that have the highest risk category based on their risk assessment.
Supplementary Information - About the Criteria-
Testing changes Changes to the cloud service are subject to appropriate testing during software development and deployment.
The type and scope of the tests correspond to the risk assessment. The tests are carried out by appropriately qualified personnel of the Cloud Service Provider or by automated test procedures that comply with the stateofthe-art. Cloud customers are involved into the tests in accordance with the contractual requirements.
The severity of the errors and vulnerabilities identified in the tests, which are relevant for the deployment decision, is determined according to defined criteria and actions for timely remediation or mitigation are initiated.
Additonal Criteria-
Supplementary Information - About the CriteriaThe errors and vulnerabilities identified in tests can be assessed, for example, according to the Common Vulnerability Scoring System (CVSS).
Logging of changes System components and tools for source code management and software deployment that are used to make changes to system components of the cloud service in the production environment are subject to a role and rights concept according to IDM-01 and authorisation mechanisms. They must be configured in such a way that all changes are logged and can therefore be traced back to the individuals or system components executing them.
Additonal Criteria-
Supplementary Information - About the Criteria-
Version Control Version control procedures are set up to track dependencies of individual changes and to restore affected system components back to their previous state as a result of errors or identified vulnerabilities.
Additonal CriteriaVersion control procedures provide appropriate safeguards to ensure that the integrity and availability of cloud customer data is not compromised when system components are restored back to their previous state.
Supplementary Information - About the Criteria-
Approvals for provision in the production environment Authorised personnel or system components of the Cloud Service Provider approve changes to the cloud service based on defined criteria (e.g. test results and required approvals) before these are made available to the cloud customers in the production environment.
Cloud customers are involved in the release according to contractual requirements.
Additonal Criteria-
Supplementary Information - About the CriteriaThe definitions for criterion DEV-03 apply.
Separation of environments Production environments are physically or logically separated from test or development environments to prevent unauthorised access to cloud customer data, the spread of malware, or changes to system components. Data contained in the production environments is not used in test or development environments in order not to compromise their confidentiality.
Additonal Criteria-
Supplementary Information - About the Criteria-

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις

3. Σχετικοί κανονισμοί

Κανονισμοί