# IAM-09 Confidentiality of Authentication Information

- Domain: IAM – Identity and Access Management
- Since C5:2020: changed (formerly IDM-08)
- Web page: https://c5.patrickscheid.de/en/iam-09/

## Basic criterion

### IAM-09.01B

The allocation of authentication information to access system components used to provide the cloud service to internal and external users of the cloud service provider and system components that are involved in automated authorisation processes of the cloud service provider is done in an orderly manner that ensures the confidentiality of the information.

**Supplementary information (on 01B, 02B, 03B, 01AC):**

Authentication information as referred to in the basic criterion is cloud service provider data.

### IAM-09.02B

Authentication credentials are managed with a security level that matches or exceeds the classification of the system component they protect.

### IAM-09.03B

If passwords are used as authentication information, their confidentiality is ensured by the following procedures, as far as technically possible:

1. Users can initially create the password themselves or shall change an initial password when logging on to the system component for the first time. An initial password loses its validity after a maximum of 14 days;
2. When creating passwords, compliance with the authentication policy (cf. IAM-08) is enforced as far as technically possible;
3. The user is informed about changing or resetting the password; and
4. The server-side storage takes place using state of the art cryptographic hash functions, with the exception of passwords that are stored in the plain text form for later use, for example in a password manager. In this case, state of the art cryptographic mechanisms are used to protect the passwords.

### IAM-09.04B

Deviations are evaluated by means of a risk assessment according to OIS-07 and mitigating measures derived from this are implemented.

### IAM-09.05B

Rules and recommendations for managing credentials in accordance with the authentication policy (cf. IAM-08) are documented, communicated and made available to all users under the responsibility of the cloud service provider. They include recommendations on password managers and recommendations to specifically address classical attacks such as phishing, social attacks, and whaling.

### IAM-09.06B

Used cryptographic mechanisms comply with the policies and instructions for cryptographic mechanisms (cf. CRY-01).

### IAM-09.07B

Password reset procedures are valid for at most 24 hours. After the reset procedure has been used, the password is to be changed by the user.

**Supplementary information:**

This subcriterion is only applicable to password-based authentication schemes.

## Additional criterion

### IAM-09.01AC (additional, complementing)

The users sign a declaration in which they assure that they treat personal (or shared) authentication information confidentially and keep it exclusively for themselves (within the members of the group).

**Supplementary information:**

Insofar as this is legally binding, declarations can be signed using an electronic signature.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Added requirement regarding the security level of authentication credentials.

Extended specification of the procedure for server-side storage of passwords to include provisions for cases in which passwords are stored for later use in plaintext.

Added requirement for the cloud service provider to provide rules and recommendations for credential management to its users.

Bullet points are now sorted to ease discussions about specific list items.

**Additional criterion:**

No change.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.