IAM · Identity and Access Management
IAM-05 Regular Review of Access Rights
Changed since C5:2020 · formerly IDM-05
Basic criterion
Modified requirement regarding the frequency of performed access rights review to include in case of significant changes as well.
Added requirements for the prevention and management of orphaned resources.
Additional criterion
Modified requirement regarding the frequency of performed access rights review to include in case of significant changes as well.
Wording in C5:2020
Basic criterion
Access rights of internal and external employees of the Cloud Service Provider as well as of system components that play a role in automated authorisation processes of the Cloud Service Provider are reviewed at least once a year to ensure that they still correspond to the actual area of use. The review is carried out by authorised persons from the Cloud Service Provider's organisational units, who can assess the appropriateness of the assigned access rights based on their knowledge of the task areas of the employees or system components. Identified deviations will be dealt with promptly, but no later than 7 days after their detection, by appropriate modification or withdrawal of the access rights.
Additional criterion
Privileged access rights are reviewed at least every six months.
Basic criterion
Identities and the associated access rights of internal and external personnel of the cloud service provider as well as of system components that play a role in automated authorisation processes of the cloud service provider are reviewed at least once a year and in case of significant changes to the cloud service to ensure that they still correspond to the actual area of use.
Supplementary information
Supplementary information
Also applies to 01AC
If a review is caused by significant changes to the cloud service, only the identities and access rights affected by the change need to be included in the review.
The review is carried out by authorised persons from the cloud service provider's organisational units, who can assess the appropriateness of the assigned access rights based on their knowledge of the task areas of the personnel or system components.
Identified deviations are dealt with timely, but no later than seven days after their detection, through appropriate modification or withdrawal of the access rights.
When revoking identities, the system ensures that all production associated system components (e.g., virtual machines, storage, access rights) are identified, reassigned, or deleted to prevent the creation of orphaned resources. Clear processes and technical controls are established to identify and handle any orphaned resources that occur despite preventive measures, ensuring their timely reassignment or secure deletion.
For system components that are not production associated, the cloud service provider designs, implements and maintains appropriate controls for the prevention of orphan resources based on a risk assessment (cf. OIS-07).
Supplementary information
Supplementary information
The system components meant here are system components in development, test or any other non-productive environments. Orphan resources are system components that have no assigned owner.
Additional criterion
IAM-05.01AC
Additional, complementingPrivileged access rights are reviewed at least every six months, and in case of significant changes to the cloud service.
Supplementary information
Also applies to 01B
If a review is caused by significant changes to the cloud service, only the identities and access rights affected by the change need to be included in the review.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources