# IAM-03 Risk-Based Procedure for Locking and Withdrawal of Identities

- Domain: IAM – Identity and Access Management
- Since C5:2020: changed (formerly IDM-03)
- Web page: https://c5.patrickscheid.de/en/iam-03/

**Supplementary information:**

This criterion applies to identities that refer to single, multiple or non-human entities.

## Basic criterion

### IAM-03.01B

The cloud service provider has a risk-based procedure in place for managing identities (cf. IAM-01), taking into account the types of data accessible via the identities of the internal and external personnel.

### IAM-03.02B

As part of this procedure, specific parameters for automatically locking and withdrawing access due to inactivity or indications of brute force attacks are defined, with exceptions for the identities whose use is restriced to emergency recovery and similar scenarios.

**Supplementary information:**

Locking can result from a longer absence of the personnel, for example, due to illness, parental leave, or sabbatical. Multiple failed login attempts can be indications of brute force attacks.

### IAM-03.03B

The cloud service provider documents and implements a process for monitoring stolen and compromised credentials, which also includes disabling any identity for which an issue is identified. This process is implemented on all identities under the responsibility of the cloud service provider that have privileged access rights.

**Supplementary information (on 03B, 03AS):**

This process can be performed automatically, or manually by authorised personnel.

### IAM-03.04B

The aforementioned process includes an exception mechanism to be applied if all identities needed to manage the situation are potentially compromised.

**Supplementary information:**

This exception mechanism should be implemented as part of the business continuity and emergency management system (cf. BCM-01), as cases where all identities needed to manage the situation described in IAM-03.03B are potentially compromised constitute an emergency.

## Additional criterion

### IAM-03.03AS (additional, sharpens 03B)

The cloud service provider documents and implements a process for monitoring stolen and compromised credentials, which also includes disabling any identity for which an issue is identified. This process is implemented on all identities under the responsibility of the cloud service provider.

### IAM-03.01AC (additional, complementing)

The context of authentication attempts is monitored and suspicious events are, as relevant, flagged to authorised persons.

**Supplementary information:**

The context of an authentication attempt can, but does not have to, include IP addresses, the date and time, or the device used.

### IAM-03.02AC (additional, complementing)

The effectiveness of the procedures for locking and withdrawing identities is validated.

### IAM-03.03AC (additional, complementing)

Timely and appropriate remediation measures address any deviations identified during validation.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Generalised requirements for locking and withdrawing access to allow cloud service provders to define appropriate parameters for their cloud service.

Added requirement to implement a process for monitoring stolen and compromised credentials and disabling identities if needed, including a mechanism for handling the edge case in which all involved identities are compromised.

**Additional criterion:**

Additional criterion newly included.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.