# IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes

- Domain: IAM – Identity and Access Management
- Since C5:2020: changed (formerly IDM-04)
- Web page: https://c5.patrickscheid.de/en/iam-04/

**Supplementary information:**

This criterion applies to identities that refer to single, multiple or non-human entities.

## Basic criterion

### IAM-04.01B

Access rights are timely adjusted or revoked if the job responsibilities of the cloud service provider's internal or external personnel or the tasks of system components involved in the cloud service provider's automated authorisation processes change.

**Supplementary information:**

Changes in the task area of internal and external personnel can be triggered by changes in the employment relationship (e.g. termination, transfer) or in contracts and agreements.

### IAM-04.02B

Privileged access rights are adjusted or revoked within 48 hours after the change taking effect.

**Supplementary information:**

For privileged access rights the definition in IAM-06 applies.

### IAM-04.03B

All other access rights are adjusted or revoked within 14 days.

### IAM-04.04B

After revocation, the procedure for granting identities and access rights (cf. IAM-02) is repeated.

### IAM-04.05B

In cases of role changes where temporary access may need to be granted, these access rights are approved, time-limited and documented.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirement regarding temporary access.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.