# IAM-02 Granting and Change of Identities and Access Rights

- Domain: IAM – Identity and Access Management
- Since C5:2020: changed (formerly IDM-02)
- Web page: https://c5.patrickscheid.de/en/iam-02/

## Basic criterion

### IAM-02.01B

Specified procedures for granting and modifying identities and access rights for internal and external personnel of the cloud service provider as well as for system components involved in automated authorisation processes of the cloud service provider ensure compliance with the role and rights policies and procedures as well as the policy for managing identities and access rights.

**Supplementary information:**

This criterion applies to identities that refer to single, multiple or non-human entities.

### IAM-02.02B

The aforementioned procedures include, but are not limited to:

1. Processes and technical controls to restrict access to the cloud service provider's data and system functions to authorised personnel; and
2. Processes and technical controls to manage and verify access permissions within the cloud service provider's systems.

### IAM-02.03B

If the cloud service provider defines break glass accounts for use in case of a non-availability of the main procedure for authentication, specific requirements and procedures for the secure usage of those accounts are defined and implemented.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Specified further requirments regarding the specified provedures for granting and modifying identities and acces rights.

Added requirement regarding the use of breakglass accounts.

**Additional criterion:**

Additional criterion removed.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.