IAM · Identity and Access Management
IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes
Changed since C5:2020 · formerly IDM-04
Basic criterion
Added requirement regarding temporary access.
Wording in C5:2020
Basic criterion
Access rights are promptly revoked if the job responsibilities of the Cloud Service Provider's internal or external staff or the tasks of system components involved in the Cloud Service Provider's automated authorisation processes change. Privileged access rights are adjusted or revoked within 48 hours after the change taking effect. All other access rights are adjusted or revoked within 14 days. After revocation, the procedure for granting user accounts and access rights (cf. IDM-02) must be repeated.
Supplementary information on all sub-criteria
This criterion applies to identities that refer to single, multiple or non-human entities.
Basic criterion
Access rights are timely adjusted or revoked if the job responsibilities of the cloud service provider's internal or external personnel or the tasks of system components involved in the cloud service provider's automated authorisation processes change.
Supplementary information
Changes in the task area of internal and external personnel can be triggered by changes in the employment relationship (e.g. termination, transfer) or in contracts and agreements.
Privileged access rights are adjusted or revoked within 48 hours after the change taking effect.
Supplementary information
For privileged access rights the definition in IAM-06 applies.
All other access rights are adjusted or revoked within 14 days.
After revocation, the procedure for granting identities and access rights (cf. IAM-02) is repeated.
In cases of role changes where temporary access may need to be granted, these access rights are approved, time-limited and documented.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources