# IAM – Identity and Access Management

- Web page: https://c5.patrickscheid.de/en/iam/

- [IAM-01 Policy for Identities and Access Rights](https://c5.patrickscheid.de/en/iam-01/index.html.md): 4 sub-criteria (3 basic, 1 additional), changed since C5:2020 (formerly IDM-01)
- [IAM-02 Granting and Change of Identities and Access Rights](https://c5.patrickscheid.de/en/iam-02/index.html.md): 3 sub-criteria (3 basic), changed since C5:2020 (formerly IDM-02)
- [IAM-03 Risk-Based Procedure for Locking and Withdrawal of Identities](https://c5.patrickscheid.de/en/iam-03/index.html.md): 8 sub-criteria (4 basic, 4 additional), changed since C5:2020 (formerly IDM-03)
- [IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes](https://c5.patrickscheid.de/en/iam-04/index.html.md): 5 sub-criteria (5 basic), changed since C5:2020 (formerly IDM-04)
- [IAM-05 Regular Review of Access Rights](https://c5.patrickscheid.de/en/iam-05/index.html.md): 6 sub-criteria (5 basic, 1 additional), changed since C5:2020 (formerly IDM-05)
- [IAM-06 Privileged Access Rights](https://c5.patrickscheid.de/en/iam-06/index.html.md): 13 sub-criteria (9 basic, 4 additional), changed since C5:2020 (formerly IDM-06)
- [IAM-07 Access to Cloud Service Customer Data](https://c5.patrickscheid.de/en/iam-07/index.html.md): 13 sub-criteria (6 basic, 7 additional), with customer criteria, changed since C5:2020 (formerly IDM-07)
- [IAM-08 Authentication Mechanisms](https://c5.patrickscheid.de/en/iam-08/index.html.md): 9 sub-criteria (7 basic, 2 additional), changed since C5:2020 (formerly IDM-09)
- [IAM-09 Confidentiality of Authentication Information](https://c5.patrickscheid.de/en/iam-09/index.html.md): 8 sub-criteria (7 basic, 1 additional), changed since C5:2020 (formerly IDM-08)

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.