BSI C5:2020 IDM-01 — Policy for user accounts and access rights

What this control requires

Documents role-based access policies per SP-01, enforcing least privilege, segregation of duties, and two-factor authentication for privileged access. Specifies account management, regular reviews, and automated blocking to protect cloud customer data from unauthorized access.

In plain English

Documents role-based access policies per SP-01, enforcing least privilege, segregation of duties, and two-factor authentication for privileged access. In practice, this means you can prove you segregation access rights-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Identity & Access Management, the assessor will trace your implementation back to the catalogue reference (Criterion IDM-01) and look for objective evidence on the latest two assessment cycles.

How to implement

Cloud Posture

CSPM. Run Wiz / Prisma / Defender for Cloud / Security Command Center over every account; auto-ticket findings above your accepted-risk threshold.

Operational checklist

• Segregation. Document the trigger, the owner and the cadence.
• Risk. Document the trigger, the owner and the cadence.
• Review. Document the trigger, the owner and the cadence.
• Data. Document the trigger, the owner and the cadence.
• Policy. Document the trigger, the owner and the cadence.
• Scope: access rights, cloud customer data, management.

Evidence to collect

• Identity Scan. IAM / IdP exports — Entra ID, Okta, IAM Identity Center, Workspace directory — showing accounts, roles, MFA state and last sign-in.
• Policy Document. A signed and version-controlled policy / standard / procedure document.

Identity analytics (Okta, SailPoint, Access Analyzer) demonstrates least-privilege. Signed policy or standard documents the safeguard. Focus: Policy for user accounts and access rights.

Common pitfalls

• Treating CSPM findings as a backlog instead of a hot queue: findings older than the policy SLA accumulate until the auditor asks why.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• ISO/IEC 27001:2022 A.8.2 — Privileged access rights
• NIST SP 800-171 Rev. 3 3.1.6 — Least Privilege - Privileged Accounts
• ISO/IEC 27701:2025 A.3.9 — Access rights
• SOC 2 (2017 TSC) CC6.2 — Access Provisioning
• CIS Controls v8 6.8 — Define and Maintain Role-Based Access Control

Related controls in BSI C5:2020

• Criterion IDM-04 — Withdraw or adjust access rights as the task area changes
• Criterion IDM-05 — Regular review of access rights
• Criterion IDM-06 — Privileged access rights
• Criterion IDM-02 — Granting and change of user accounts and access rights
• Criterion IDM-03 — Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins
• Criterion IDM-07 — Access to cloud customer data

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion IDM-01

Topics: governance riskidentity accessprivileged accessidentity managementaccess reviewcloud posture