PSS · Product Safety and Security
PSS-05 Authentication Mechanisms
Changed since C5:2020
Basic criterion
Replaced requirement for strong authentication with requirement for multi-factor authentication.
Realigned requirement regarding the enforcement of authentication mechanism to be about providing the cloud service customer with the ability to enforce the mechanisms.
Additional criterion
No change.
Wording in C5:2020
Basic criterion
The Cloud Service Provider provides authentication mechanisms that can force strong authentication (e.g. two or more factors) for users, IT components or applications within the cloud users' area of responsibility.
These authentication mechanisms are set up at all access points that allow users, IT components or applications to interact with the cloud service.
For privileged users, IT components or applications, these authentication mechanisms are enforced.
Additional criterion
The cloud service offers out-of-band authentication (OOB), in which the factors are transmitted via different channels (e.g. Internet and mobile network).
Supplementary information on all sub-criteria
IT components in the sense of this criterion are independently usable objects with external interfaces that can be connected with other IT components.
Access points in the sense of this criterion are those that can be accessed by users, IT components or applications via networks (for users, for example, the login screen on the publicly accessible website of the cloud service provider).
Multi-factor authentication should be enforced and can e.g. be performed with cryptographic certificates, smart cards or tokens.
Basic criterion
The cloud service provided is equipped with authentication mechanisms that can force multi-factor authentication for users, IT components or applications within the cloud service customers' area of responsibility. These authentication mechanisms are set up at all access points that allow users, IT components or applications to interact with the cloud service.
For privileged users, IT components or applications under the responsibility of the cloud service customer, these authentication mechanisms can be enforced by the cloud service customer.
Additional criterion
PSS-05.01AC
Additional, complementingThe cloud service offers out-of-band (OOB) authentication, in which the factors are transmitted via different channels (e.g. Internet and mobile network).
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that the authentication mechanisms offered by the cloud service are used in accordance with the customer's identity and authorisation management requirements. If cloud service customers operate virtual machines or containers with the cloud service, they ensure with suitable controls that the authentication mechanisms cover container-specific scenarios, such as multi-factor authentication for container hosts and registry access.
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources