IAM · Identity and Access Management
IAM-02 Granting and Change of Identities and Access Rights
Changed since C5:2020 · formerly IDM-02
Basic criterion
Specified further requirments regarding the specified provedures for granting and modifying identities and acces rights.
Added requirement regarding the use of breakglass accounts.
Additional criterion
Additional criterion removed.
Wording in C5:2020
Basic criterion
Specified procedures for granting and modifying user accounts and access rights for internal and external employees of the Cloud Service Provider as well as for system components involved in automated authorisation processes of the Cloud Service Provider ensure compliance with the role and rights concept as well as the policy for managing user accounts and access rights.
Additional criterion
The Cloud Service Provider offers cloud customers a self-service with which they can independently assign and change user accounts and access rights.
Basic criterion
Specified procedures for granting and modifying identities and access rights for internal and external personnel of the cloud service provider as well as for system components involved in automated authorisation processes of the cloud service provider ensure compliance with the role and rights policies and procedures as well as the policy for managing identities and access rights.
Supplementary information
This criterion applies to identities that refer to single, multiple or non-human entities.
The aforementioned procedures include, but are not limited to:
- Processes and technical controls to restrict access to the cloud service provider's data and system functions to authorised personnel; and
- Processes and technical controls to manage and verify access permissions within the cloud service provider's systems.
If the cloud service provider defines break glass accounts for use in case of a non-availability of the main procedure for authentication, specific requirements and procedures for the secure usage of those accounts are defined and implemented.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources