IAM · Identity and Access Management
IAM-09 Confidentiality of Authentication Information
Changed since C5:2020 · formerly IDM-09
Basic criterion
Rephrased requirement to enforce multi-factor authentication for access to the production environment, further explicitly extended this requirement to automated processes.
Changed the previously require password policy into an authentication policy. Further added requirements regarding the content of the authentication policy.
Added requirement to consider the risk of authentication mechanisms becoming outdated during the risk assessment.
Added requirement for all authentication mechanisms to be capable of disabling identities after several unsuccessful authentication attempts.
Specified prerequisites for accessing a non-personal identities assigned to multiple persons.
Additional criterion
Rephrased requirement to enforce multi-factor authentication for access to any environment.
Linked the additional criterion to the policies and procedures for the use of cryptographic mechanisms.
Wording in C5:2020
Basic criterion
System components in the Cloud Service Provider's area of responsibility that are used to provide the cloud service, authenticate users of the Cloud Service Provider's internal and external employees as well as system components that are involved in the Cloud Service Provider's automated authorisation processes. Access to the production environment requires two-factor or multi-factor authentication. Within the production environment, user authentication takes place through passwords, digitally signed certificates or procedures that achieve at least an equivalent level of security. If digitally signed certificates are used, administration is carried out in accordance with the Guideline for Key Management (cf. CRY-01). The password requirements are derived from a risk assessment and documented, communicated and provided in a password policy according to SP-01. Compliance with the requirements is enforced by the configuration of the system components, as far as technically possible.
Additional criterion
Access to the non-production environment requires two-factor or multi-factor authentication. Within the non-production environment, users are authenticated using passwords, digitally signed certificates, or procedures that provide at least an equivalent level of security.
Basic criterion
The allocation of authentication information to access system components used to provide the cloud service to internal and external users of the cloud service provider and system components that are involved in automated authorisation processes of the cloud service provider is done in an orderly manner that ensures the confidentiality of the information.
Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.
If passwords are used as authentication information, their confidentiality is ensured by the following procedures, as far as technically possible:
- Users can initially create the password themselves or shall change an initial password when logging on to the system component for the first time. An initial password loses its validity after a maximum of 14 days;
- When creating passwords, compliance with the authentication policy (cf. IAM-08) is enforced as far as technically possible;
- The user is informed about changing or resetting the password; and
- The server-side storage takes place using state of the art cryptographic hash functions, with the exception of passwords that are stored in the plain text form for later use, for example in a password manager. In this case, state of the art cryptographic mechanisms are used to protect the passwords.
Deviations are evaluated by means of a risk assessment according to OIS-07 and mitigating measures derived from this are implemented.
Rules and recommendations for managing credentials in accordance with the authentication policy (cf. IAM-08) are documented, communicated and made available to all users under the responsibility of the cloud service provider. They include recommendations on password managers and recommendations to specifically address classical attacks such as phishing, social attacks, and whaling.
Used cryptographic mechanisms comply with the policies and instructions for cryptographic mechanisms (cf. CRY-01).
Password reset procedures are valid for at most 24 hours. After the reset procedure has been used, the password is to be changed by the user.
Supplementary information
This subcriterion is only applicable to password-based authentication schemes.
Additional criterion
IAM-09.01AC
Additional, complementingThe users sign a declaration in which they assure that they treat personal (or shared) authentication information confidentially and keep it exclusively for themselves (within the members of the group).
Supplementary information
Supplementary information
Insofar as this is legally binding, declarations can be signed using an electronic signature.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources