Domains

IAM

Identity and Access Management

9 criteria, 49 basic and 20 additional sub-criteria

• IAM-01Policy for Identities and Access Rights4 sub-criteria: 3 basic, 1 additional
• IAM-02Granting and Change of Identities and Access Rights3 sub-criteria
• IAM-03Risk-Based Procedure for Locking and Withdrawal of Identities8 sub-criteria: 4 basic, 4 additional
• IAM-04Withdrawal or Adjustment of Access Rights as the Task Area Changes5 sub-criteria
• IAM-05Regular Review of Access Rights6 sub-criteria: 5 basic, 1 additional
• IAM-06Privileged Access Rights13 sub-criteria: 9 basic, 4 additional
• IAM-07Access to Cloud Service Customer Data13 sub-criteria: 6 basic, 7 additional, with customer criteria
• IAM-08Authentication Mechanisms9 sub-criteria: 7 basic, 2 additional
• IAM-09Confidentiality of Authentication Information8 sub-criteria: 7 basic, 1 additional

BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources