PSS · Product Safety and Security
PSS-07 Confidentiality of Authentication Information
Changed since C5:2020
Basic criterion
Realigned requirement regarding the procedures for protecting the confidentiality of passwords to be about the cloud service provider providing the cloud service customer with these procedures.
Provided further specifications regarding the password reset procedure.
Added requirement to make rules and recommendations available to cloud service customers.
Added requirement to use additional security mechanisms for distributing credentials.
Bullet points are now sorted to ease discussions about specific list items.
Wording in C5:2020
Basic criterion
If passwords are used as authentication information for the cloud service, their confidentiality is ensured by the following procedures:
- Users can initially create the password themselves or must change an initial password when logging in to the cloud service for the first time. An initial password loses its validity after a maximum of 14 days.
- When creating passwords, compliance with the length and complexity requirements of the Cloud Service Provider (cf. IDM-09) or the cloud customer is technically enforced.
- The user is informed about changing or resetting the password.
- The server-side storage takes place using state-of-the-art cryptographically strong hash functions in combination with at least 32-bit long salt values.
Basic criterion
If passwords are used as authentication information for the cloud service, the cloud service provider provides the cloud service customers with the following procedures to protect the confidentiality of the passwords:
- Users can initially create the password themselves or must change an initial password when logging in to the cloud service for the first time. An initial password loses its validity after a maximum of 14 days;
- When creating passwords, compliance with the length and complexity requirements of the cloud service provider (cf. IAM-08) or the cloud service customer is technically enforced;
- The user is informed about changing or resetting the password. Password reset procedures are valid for at most 48 hours. After the reset procedure has been used, the password is to be changed by the user; and
- The server-side storage uses hash functions in combination with salt values, both corresponding to the state of the art.
Supplementary information
The state of the art regarding cryptographic hash functions is described in the current version of the BSI Technical Guideline TR-02102-1 'Cryptographic Mechanisms: Recommendations and Key Lengths'.
Rules and recommendations are shared with the cloud service customers as applicable to the users under their responsibility. The cloud service provider offers the cloud service customers tools for the management and enforcement of these rules.
When distributing credentials, the cloud service provider verifies the recipient's identity, validates the request and protects the credentials by using additional security mechanisms such as multi-factor authentication.
Complementary customer criteria
What cloud service customers implement on their side.
Cloud service customers ensure with suitable controls that they use sufficiently secure passwords (cf. IAM-08) and employ the procedures provided by the cloud service provider to protect the confidentiality of the passwords according to their own assessment, and that the risks of unauthorised access associated with their own choice are borne. If cloud service customers operate virtual machines or containers with the cloud service, they ensure with suitable controls that the confidentiality of the information is also ensured for the allocation of authentication information of the virtual machines or containers.
Related criteria
BSI text from C5:2026 and its changelog: © Federal Office for Information Security 2026, reproduced unchanged under CC BY-ND 4.0. Unofficial site, not affiliated with BSI. Licence and sources