IAM · Identity and Access Management
IAM-07 Access to Cloud Service Customer Data
Changed since C5:2020 · formerly IDM-07
Basic criterion
Specified which data types the criterion applies to.
Added requirements for partitioning measures between the system components for providing the cloud service and other system components, which reduce the impact of a compromise.
Added the geographical location of an access to the information provided to the cloud service customers.
Added requirement for informing cloud service customers about potential accesses before the service is offered.
Additional criterion
Specified which data types the criterion applies to.
Modified phrasing of existing additional criterion to be more similar to the phrasing of the basic criterion that is being sharpened.
Extended the list of situations in which the cloud service provider needs to ask for consent of the cloud service customer before an access by the edge case in which encrypted data and its decryption key are stored in the same cloud environment and might be accessed together.
Added the geographical location of an access to the information provided to the cloud service customers.
Added requirement for informing cloud service customers about potential accesses before the service is offered.
Added requirement for invluding provisions for cases where it is not feasible to ask for consent prior to an access.
Added requirements for personnel that access cloud service customer data to pass an assessment first, or be supervised otherwise. Further added requirements regarding the performance of a supervised access.
Wording in C5:2020
Basic criterion
The cloud customer is informed by the Cloud Service Provider whenever internal or external employees of the Cloud Service Provider read or write to the cloud customer's data processed, stored or transmitted in the cloud service or have accessed it without the prior consent of the cloud customer. The Information is provided whenever data of the cloud customer is/was not encrypted, the encryption is/was disabled for access or the contractual agreements do not explicitly exclude such information. The information contains the cause, time, duration, type and scope of the access. The information is sufficiently detailed to enable subject matter experts of the cloud customer to assess the risks of the access. The information is provided in accordance with the contractual agreements, or within 72 hours after the access.
Additional criterion
Access to the data processed, stored or transmitted in the cloud service by internal or external employees of the Cloud Service Provider requires the prior consent of an authorised department of the cloud customer, provided that the cloud customer's data is not encrypted, encryption is disabled for access, or contractual agreements do not explicitly exclude such consent. For the consent, the cloud customer's department is provided with meaningful information about the cause, time, duration, type and scope of the access supporting assessing the risks associated with the access.
Basic criterion
The cloud service provider implements partitioning measures that are:
The partitioning measures of the cloud service provider ensure that security incidents, if they compromise the system components storing the cloud service customer data, do not also compromise the system components that manage the access to them.
Unless prohibited by applicable law, the cloud service customer is informed by the cloud service provider whenever internal or external personnel of the cloud service provider reads or writes to the cloud service customer data processed, stored or transmitted in the cloud service or has accessed it without the prior consent of the cloud service customer. The information is provided whenever cloud service customer data is/was accessed in unencrypted form or the contractual agreements with customers do not explicitly exclude informing the customer of such access.
Supplementary information
Also applies to 04B, 05B, 06B, 03AS, 04AS, 01AC, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
Unless contractually agreed otherwise, the information provided about the access contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The information is sufficiently detailed to enable subject matter experts of the cloud service customer to assess the risks of the access.
Supplementary information
Also applies to 04AS
Subject matter experts in the sense of this basic criterion are personnel from e.g. IT, Compliance or Internal Audit.
Supplementary information
Also applies to 03B, 05B, 06B, 03AS, 04AS, 01AC, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
Supplementary information
Also applies to 04AS
The geographic location of the access provided to the cloud service customer need not be a GPS location, but should at least be as precise as the country from which the access has been or is meant to be performed.
The information is provided in accordance with the contractual agreements, but no later than 72 hours from the initiation of the access.
Supplementary information
Also applies to 03B, 04B, 06B, 03AS, 04AS, 01AC, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
The cloud service provider discloses, through contractual agreements and before offering its services, all instances where the cloud service provider may access cloud service customer data in unencrypted form while it is processed, stored or transmitted in the cloud service.
Supplementary information
Also applies to 03B, 04B, 05B, 03AS, 04AS, 01AC, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
Additional criterion
IAM-07.03AS
Additional, sharpens03BAccess to cloud service customer data and cloud service derived data by internal or external personnel of the cloud service provider requires the prior consent of an authorised department of the cloud service customer, provided that the cloud service customer's data is accessible in unencrypted form or contractual agreements do not explicitly exclude such consent. Additionally, if encrypted data and its decryption key are stored separately within the same cloud environment, prior consent is required not only for accessing the decryption key but also for accessing the encrypted data itself (potentially together with the key).
Supplementary information
Also applies to 03B, 04B, 05B, 06B, 04AS, 01AC, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
IAM-07.04AS
Additional, sharpens04BUnless contractually agreed otherwise, the information provided for the consent contains the cause, time, duration, geographic location, type and scope of the access, as well as the retention time of other data generated during access, such as logs or copies containing cloud service customer data. The information is sufficiently detailed to enable subject matter experts of the cloud service customer to assess the risks of the access. In addition to the provided information, the cloud service provider specifies a time frame within which the cloud service customer shall respond to the access request.
Supplementary information
Also applies to 04B
Subject matter experts in the sense of this basic criterion are personnel from e.g. IT, Compliance or Internal Audit.
Supplementary information
Also applies to 03B, 04B, 05B, 06B, 03AS, 01AC, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
Supplementary information
Also applies to 04B
The geographic location of the access provided to the cloud service customer need not be a GPS location, but should at least be as precise as the country from which the access has been or is meant to be performed.
IAM-07.06AS
Additional, sharpens06BThe cloud service provider discloses, through contractual agreements and before offering its services, all instances where the cloud service provider may access cloud service customer data or cloud service derived data in unencrypted form while it is processed, stored or transmitted in the cloud service.
IAM-07.01AC
Additional, complementingIf the cloud service provider might access the cloud service customer data transmitted, handled or stored in the cloud service in a non-encrypted way, the cloud service provider includes provisions through contractual agreements for cases in which seeking prior consent for such an access is not feasible.
Supplementary information
This subcriterion is only applicable if subcriterion IAM-07.03S is also applied.
Seeking prior consent might, for example, not be feasible where the cloud service needs to be troubleshot to preserve the confidentiality, integrity and availability of cloud service customer data.
Supplementary information
Also applies to 03B, 04B, 05B, 06B, 03AS, 04AS, 02AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
IAM-07.02AC
Additional, complementingIn order to be able to directly or indirectly access cloud service customer data, any internal or external personnel of the cloud service provider has to pass an appropriate assessment, or has to instead be supervised by personnel who has passed an appropriate assessment (cf. HR-01). The cloud service provider verifies that one of these conditions is met before the access is granted. This applies to support operations as well.
Supplementary information
Also applies to 03B, 04B, 05B, 06B, 03AS, 04AS, 01AC, 03AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
Supplementary information
Also applies to 03AC
The cloud service provider should make details about how the supervised access is performed accessible to cloud service customers.
IAM-07.03AC
Additional, complementingIf the performed access is supervised, the cloud service provider ensures that:
- The mechanisms used to perform the supervised access allow the supervising personnel to authorise or deny individual actions of the supervisee and ask for explanations in real time;
- Any access rights that are granted as part of the supervised access are revoked at the end of the operation;
- All operations that are performed as part of the supervised access are logged as administration actions;
- The supervisee and the device used to perform the supervised access are authenticated by the supervision solution;
- The operations that the supervisee proposes and the actions of the supervising personnel are logged by the supervision solution, including operations that were denied; and
- Information flows towards the device of the supervisee are prevented by the supervision solution.
Supplementary information
Also applies to 03B, 04B, 05B, 06B, 03AS, 04AS, 01AC, 02AC
Access to cloud service customer data also entails disclosure of data as part of investigation requests according to INQ-03. These are to be communicated to cloud service customers as far as it is legally not forbidden.
The criterion aims at minimising the cloud service provider's capability to access cloud service customer data. Minimisation of the cloud service provider's possibility to access cloud service customer data is often a question related to the radius of the collusion circle. For example, if the four-eyes principle for access is applied and the access is being logged, then three people make up the collusion circle. In order to build trust into such access statements, the cloud service provider should describe in the system description the measures taken to enlargen the collusion circle.
Supplementary information
Also applies to 02AC
The cloud service provider should make details about how the supervised access is performed accessible to cloud service customers.
IAM-07.04AC
Additional, complementingIf the cloud service customer is given access to interfaces for administrators and for end users as part of the cloud service, the cloud service provider separates these interfaces from one another and ensures that access paths for customer administrators differ from those for end users.
Supplementary information
The separation should be designed and implemented such that customer administrators can access the cloud service even when the end user interfaces are unavailable.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that their contracts with the cloud service provider include a comprehensive list of all instances where the provider might access customer data in an unencrypted form. Cloud service customers verify that these conditions are thoroughly documented before engaging the services, allowing them to make informed decisions about data security and compliance.
Cloud service customers ensure with suitable controls that they provide a response to data access requests by the cloud service provider within a specified time frame as agreed upon in the contractual agreements.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources