# IAM-05 Regular Review of Access Rights

- Domain: IAM – Identity and Access Management
- Since C5:2020: changed (formerly IDM-05)
- Web page: https://c5.patrickscheid.de/en/iam-05/

## Basic criterion

### IAM-05.01B

Identities and the associated access rights of internal and external personnel of the cloud service provider as well as of system components that play a role in automated authorisation processes of the cloud service provider are reviewed at least once a year and in case of significant changes to the cloud service to ensure that they still correspond to the actual area of use.

**Supplementary information (on 01B, 02B, 03B, 04B, 05B):**

This criterion applies to identities that refer to single, multiple or non-human entities.

As an alternative to the regular reviews of access rights, time-bound access rights that automatically expire may also be issued.

**Supplementary information (on 01B, 01AC):**

If a review is caused by significant changes to the cloud service, only the identities and access rights affected by the change need to be included in the review.

### IAM-05.02B

The review is carried out by authorised persons from the cloud service provider's organisational units, who can assess the appropriateness of the assigned access rights based on their knowledge of the task areas of the personnel or system components.

### IAM-05.03B

Identified deviations are dealt with timely, but no later than seven days after their detection, through appropriate modification or withdrawal of the access rights.

### IAM-05.04B

When revoking identities, the system ensures that all production associated system components (e.g., virtual machines, storage, access rights) are identified, reassigned, or deleted to prevent the creation of orphaned resources. Clear processes and technical controls are established to identify and handle any orphaned resources that occur despite preventive measures, ensuring their timely reassignment or secure deletion.

### IAM-05.05B

For system components that are not production associated, the cloud service provider designs, implements and maintains appropriate controls for the prevention of orphan resources based on a risk assessment (cf. OIS-07).

**Supplementary information:**

The system components meant here are system components in development, test or any other non-productive environments. Orphan resources are system components that have no assigned owner.

## Additional criterion

### IAM-05.01AC (additional, complementing)

Privileged access rights are reviewed at least every six months, and in case of significant changes to the cloud service.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Modified requirement regarding the frequency of performed access rights review to include in case of significant changes as well.

Added requirements for the prevention and management of orphaned resources.

**Additional criterion:**

Modified requirement regarding the frequency of performed access rights review to include in case of significant changes as well.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.