IAM-02 Granting and Change of Identities and Access Rights

Specified procedures for granting and modifying identities and access rights for internal and external personnel of the cloud service provider as well as for system components involved in automated authorisation processes of the cloud service provider ensure compliance with the role and rights policies and procedures as well as the policy for managing identities and access rights.

Supplementary information

This criterion applies to identities that refer to single, multiple or non-human entities.

The aforementioned procedures include, but are not limited to:

1. Processes and technical controls to restrict access to the cloud service provider's data and system functions to authorised personnel; and

2. Processes and technical controls to manage and verify access permissions within the cloud service provider's systems.

If the cloud service provider defines break glass accounts for use in case of a non-availability of the main procedure for authentication, specific requirements and procedures for the secure usage of those accounts are defined and implemented.