# PSS-09 Authorisation Mechanisms

- Domain: PSS – Product Safety and Security
- Since C5:2020: changed
- Web page: https://c5.patrickscheid.de/en/pss-09/

## Basic criterion

### PSS-09.01B

Access to the functions provided by the cloud service is restricted by access controls (authorisation mechanisms) that verify whether users, IT components, or applications are authorised to perform certain actions.

### PSS-09.02B

The cloud service provider validates the functionality of the authorisation mechanisms before new functions are made available to cloud service customers and in the event of changes to the authorisation mechanisms of existing functions (cf. DEV-07).

### PSS-09.03B

If validation activities reveal vulnerabilities, the procedures for identifying vulnerabilities (cf. PSS-02) are applied and measures for timely remediation or mitigation are initiated.

## Additional criterion

### PSS-09.01AC (additional, complementing)

Access controls are attribute-based to enable granular and contextual checks against multiple attributes of a user, IT component, or application (e.g., role, location, authentication method).

## Complementary customer criteria

Cloud service customers ensure with suitable controls that system components under their responsibility are regularly checked for vulnerabilities and to mitigate these by appropriate measures.

## Changes since C5:2020

From BSI's C5:2026 changelog.

**Basic criterion:**

Replaced previous requirements regarding vulnerabilities with the requirement that the procedures for identifying vulnerabilities are applied.

**Additional criterion:**

No change.

---

Source: BSI C5:2026, machine-readable edition v1.0.1, © Federal Office for Information Security (BSI) 2026, reproduced unchanged under CC BY-ND 4.0 (https://creativecommons.org/licenses/by-nd/4.0/). Change notes: BSI C5:2026 Changelog, © BSI 2026, CC BY-ND 4.0. Unofficial presentation, not affiliated with BSI.