C5 domain IAM: making access rights, access and evidence audit-ready

This page covers the IAM domain (Identity and Access Management) of C5:2026, section 5.7 of the catalogue. How criteria and subcriteria are structured in general is explained on the page C5 criteria catalogue.

What is the IAM domain about?

IAM secures the provider’s own access. The catalogue states the objective as “Secure the authorisation and authentication of users of the cloud service provider to prevent unauthorised access” (section 5.7). The German version of the catalogue adds that these are usually privileged users. This means internal and external personnel as well as system components that have a role in automated authorisation processes, that is, technical accounts and service identities. How your customers’ users sign in and which roles they have in the service is governed by PSS-05 to PSS-09 in the Product security domain.

The domain comprises nine criteria, IAM-01 to IAM-09, with 49 basic subcriteria, 6 sharpening and 14 complementing additional subcriteria. In C5:2020 it was called IDM; no IAM criterion is new without a predecessor. The numbers IDM-01 to IDM-07 map to IAM-01 to IAM-07. For 08 and 09 the topics are swapped: the authentication mechanisms (C5:2020 IDM-09) are now in IAM-08, the confidentiality of authentication information (C5:2020 IDM-08) in IAM-09. The BSI change history still shows the old order here, so map old controls by their topic.

Starting point: a SaaS provider before its first audit

Fictitious example, not a client. A provider runs a platform for video consultations and appointment management for medical practices. The service runs on the infrastructure of a large cloud service provider, in a managed Kubernetes cluster and a managed database. Around 60 employees, including an operations team of six, a support team and two external developers from a service provider. Sign-in runs through a central identity service with single sign-on.

Before the project, the situation looks like this:

• Administrators sign in to the platform console with multi-factor authentication; deploy pipelines and database maintenance scripts, by contrast, use long-lived static access keys.
• The support team can switch into any practice tenant through an internal admin interface to reproduce errors. The practices are not told about it.
• HR reports leavers to operations by email. Only purchasing knows when the contracts of the external developers end.
• For an outage of the identity service there are two break glass accounts whose passwords are in the vault; when they were last used is not recorded.

Each of these points touches a different criterion. The following sections show where the boundaries of responsibility lie, what a control looks like and what evidence the auditor expects.

Who is responsible for what: provider, platform, customer?

IAM lies almost entirely with the provider. The platform supplies tools, the customer is mainly involved in IAM-07. Our classification for the example:

In the IAM domain only IAM-07 contains complementary customer criteria; for the other eight criteria the catalogue shows a dash there. Whichever customer controls you assume for your service belong in the system description as complementary customer controls (CUEC). The auditor does not test them at the customer, only whether they are presented appropriately.

Example control description for IAM-04

IAM-04 requires access rights to be adjusted or revoked in a timely manner when job responsibilities change. The basic subcriteria set two fixed deadlines: privileged access rights “within 48 hours after the change taking effect” (IAM-04.02B), all others “within 14 days” (IAM-04.03B). After revocation, the granting procedure under IAM-02 is repeated, and temporary access rights for role changes are approved, time-limited and documented. Our example control for the provider above (own wording, not catalogue text):

The internal target time below the catalogue deadline is our recommendation: it leaves a buffer for weekends and public holidays. Whether the control covers all subcriteria is for the auditor to judge; for a type 2 report the auditor also tests whether it was effective over the whole period.

What evidence the auditor wants to see

For IAM most evidence is produced automatically in the identity service, the ticket system and the logs. What matters is that it is available for the whole audit period and has the right timing. Examples from our scenario:

An evidence register records which evidence belongs to which subcriterion and when it is due; how to keep one is shown on the page Evidence and documentation.

Possible gaps: cause, effect, remedy

The following gaps follow from the wording of the criteria and the scenario above. For all of them: if a single subcriterion is not met, the criterion counts as not met, and the auditor reports the deviation (sections 3.4.12 and 3.4.13).

Which of these gaps actually block the audit and in which order you close them is a question of prioritising measures across all domains.

All criteria of the IAM domain

Titles as in the English version 1.0.1, number of subcriteria counted per section 5 (B = basic, AS = sharpening, AC = complementing). The column “What it covers” is our own short description, not catalogue text; the wording of the criteria in the catalogue is binding.

Additional criteria with an effect in sales include IAM-06.03AC (phishing-resistant multi-factor authentication for privileged users), IAM-06.04AC (privileged access management solution with elevation only when needed) and IAM-07.03AS (prior consent of the customer instead of information after the fact). Which ones you include depends on the contracts with your customers.

Relationship to ISO/IEC 27001:2022 Annex A

The following mapping is our own, unofficial classification by topic. The BSI has not yet published a cross-reference for C5:2026. The catalogue refers to the BSI website for it (section 3.3). So far the table there covers C5:2020 only, and the BSI says the table for C5:2026 is “scheduled for publication in the near future” (as of 6 November 2026). According to the catalogue, even an official table only shows thematic proximity, not fulfilment of the criteria (section 3.3). The short labels are ours, not titles from the standard.