BSI C5:2020 IDM-09 — Authentication mechanisms

What this control requires

Requires two-factor authentication for production environment access, using passwords, certificates, or equivalent methods per CRY-01. Enforces risk-based password policies per SP-01, ensuring secure access to cloud customer data and systems.

In plain English

Requires two-factor authentication for production environment access, using passwords, certificates, or equivalent methods per CRY-01. In practice, this means you can prove you risk cloud customer data-level controls on a defined cadence.

Why it matters

BSI C5 is the default cloud-security baseline German public-sector buyers and many DAX-listed enterprises expect; gaps here directly block procurement in the DACH region and frequently appear as must-have items in EU public-tender documents.

This control is rated high. Auditors expect a named owner, a remediation SLA, and a tooling artefact that evidences continuous operation.

What an auditor looks for

A C5 attesting auditor (under ISAE 3000 / IDW PS 860) tests both the design and — for a Type 2 — the operating effectiveness over the attestation period. For each criterion they look for both the Basic and any in-scope Additional objectives.

Within Identity & Access Management, the assessor will trace your implementation back to the catalogue reference (Criterion IDM-09) and look for objective evidence on the latest two assessment cycles.

How to implement

1. Write a short policy stating intent, scope and named owner.
2. Encode it as a platform guardrail — SCP, Azure Policy initiative, Organisation Policy, or repository policy.
3. Wire a monitoring signal that catches drift (CSPM rule, SIEM rule, scheduled query, Workspace alert) and ticket it.
4. Review on a documented cadence and capture the review in the risk register or compliance tracker.

Operational checklist

• Risk. Document the trigger, the owner and the cadence.
• Review. Document the trigger, the owner and the cadence.
• Data. Document the trigger, the owner and the cadence.
• Access. Document the trigger, the owner and the cadence.
• Authentication. Document the trigger, the owner and the cadence.
• Scope: cloud customer data, mechanisms, management.

Evidence to collect

• Identity Scan. IAM / IdP exports — Entra ID, Okta, IAM Identity Center, Workspace directory — showing accounts, roles, MFA state and last sign-in.
• Infra Scan. Continuous infrastructure-posture telemetry — AWS Config, Azure Policy compliance, GCP Organisation Policy, Wiz / Prisma findings.

Identity analytics (Okta, SailPoint, Access Analyzer) demonstrates least-privilege. Focus: Authentication mechanisms.

How it maps to other frameworks

Computed from shared tags, control component and key-operation subjects — handy when you are reconciling controls across an audit.

• ISO/IEC 27001:2022 A.8.23 — Web filtering
• SOC 2 (2017 TSC) CC1.5 — Accountability for Internal Control Responsibilities
• NIST SP 800-171 Rev. 3 3.13.4 — Information in Shared System Resources
• CIS Controls v8 9.2 — Use DNS Filtering Services
• NIST SP 800-53 Rev. 5 PE-15(1) — Automation Support

Related controls in BSI C5:2020

• Criterion IDM-03 — Locking and withdrawal of user accounts in the event of inactivity or multiple failed logins
• Criterion IDM-07 — Access to cloud customer data
• Criterion IDM-05 — Regular review of access rights
• Criterion PSS-09 — Authorisation Mechanisms
• Criterion AM-05 — Commitment to Permissible Use, Safe Handling and Return of Assets
• Criterion HR-01 — Verification of qualification and trustworthiness

References

• Bundesamt für Sicherheit in der Informationstechnik (BSI) — BSI C5:2020
• Catalogue identifier: Criterion IDM-09

Topics: identity accessidentity managementaccess reviewprivileged accesscertificate management