IAM · Identity and Access Management
IAM-03 Risk-Based Procedure for Locking and Withdrawal of Identities
Changed since C5:2020 · formerly IDM-03
Basic criterion
Generalised requirements for locking and withdrawing access to allow cloud service provders to define appropriate parameters for their cloud service.
Added requirement to implement a process for monitoring stolen and compromised credentials and disabling identities if needed, including a mechanism for handling the edge case in which all involved identities are compromised.
Additional criterion
Additional criterion newly included.
Wording in C5:2020
Basic criterion
User accounts of internal and external employees of the Cloud Service Provider as well as for system components involved in automated authorisation processes of the Cloud Service Provider are automatically locked if they have not been used for a period of two months. Approval from authorised personnel or system components are required to unlock these accounts.
Locked user accounts are automatically revoked after six months. After revocation, the procedure for granting user accounts and access rights (cf. IDM-02) must be repeated.
Supplementary information on all sub-criteria
This criterion applies to identities that refer to single, multiple or non-human entities.
Basic criterion
The cloud service provider has a risk-based procedure in place for managing identities (cf. IAM-01), taking into account the types of data accessible via the identities of the internal and external personnel.
As part of this procedure, specific parameters for automatically locking and withdrawing access due to inactivity or indications of brute force attacks are defined, with exceptions for the identities whose use is restriced to emergency recovery and similar scenarios.
Supplementary information
Locking can result from a longer absence of the personnel, for example, due to illness, parental leave, or sabbatical. Multiple failed login attempts can be indications of brute force attacks.
The cloud service provider documents and implements a process for monitoring stolen and compromised credentials, which also includes disabling any identity for which an issue is identified. This process is implemented on all identities under the responsibility of the cloud service provider that have privileged access rights.
Supplementary information
Also applies to 03AS
This process can be performed automatically, or manually by authorised personnel.
The aforementioned process includes an exception mechanism to be applied if all identities needed to manage the situation are potentially compromised.
Additional criterion
IAM-03.03AS
Additional, sharpens03BThe cloud service provider documents and implements a process for monitoring stolen and compromised credentials, which also includes disabling any identity for which an issue is identified. This process is implemented on all identities under the responsibility of the cloud service provider.
Supplementary information
Also applies to 03B
This process can be performed automatically, or manually by authorised personnel.
IAM-03.01AC
Additional, complementingThe context of authentication attempts is monitored and suspicious events are, as relevant, flagged to authorised persons.
Supplementary information
The context of an authentication attempt can, but does not have to, include IP addresses, the date and time, or the device used.
IAM-03.02AC
Additional, complementingThe effectiveness of the procedures for locking and withdrawing identities is validated.
IAM-03.03AC
Additional, complementingTimely and appropriate remediation measures address any deviations identified during validation.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources