IAM-04 Withdrawal or Adjustment of Access Rights as the Task Area Changes

Access rights are timely adjusted or revoked if the job responsibilities of the cloud service provider's internal or external personnel or the tasks of system components involved in the cloud service provider's automated authorisation processes change.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

Changes in the task area of internal and external personnel can be triggered by changes in the employment relationship (e.g. termination, transfer) or in contracts and agreements.

Privileged access rights are adjusted or revoked within 48 hours after the change taking effect.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

Supplementary information

For privileged access rights the definition in IAM-06 applies.

All other access rights are adjusted or revoked within 14 days.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

After revocation, the procedure for granting identities and access rights (cf. IAM-02) is repeated.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

In cases of role changes where temporary access may need to be granted, these access rights are approved, time-limited and documented.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.