What evidence do auditors commonly ask for on IDM-08 Confidentiality of authentication information?

Procedure for issuing initial credentials and the channel used to convey them to the recipient; Setting that expires an unused initial password after at most fourteen days; Hashing algorithm and parameters applied to stored credentials; Copy of the message a user receives after a password change or reset.

What is the most common gap auditors find on IDM-08?

Initial passwords identical or built from a predictable pattern across new starters

BSI C5 (121-criteria catalogue) · C5: Identity and Access Management

`IDM-08` Confidentiality of authentication information

Hand out authentication secrets in a controlled manner that preserves confidentiality, force initial passwords to be replaced at first logon and to expire within fourteen days, inform users of resets, and store passwords as strong cryptographic hashes.

Source: BSI C5 (121-criteria catalogue), IDM-08. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open BSI C5 (121-criteria catalogue) in the compliance library.

The edition of the catalogue is not stamped here; check the edition your attestation is issued against.

artefacts

held by a system

at each review

moderate

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Setting that expires an unused initial password after at most fourteen days · Identity provider / directory

periodic reviewEvidence produced at each review

none for this control

governing documentDocuments that govern the control

Procedure for issuing initial credentials and the channel used to convey them to the recipient · Policy repository / GRC workspace
Hashing algorithm and parameters applied to stored credentials · Policy repository / GRC workspace
Copy of the message a user receives after a password change or reset · Policy repository / GRC workspace

First move

Start with the 1 of 4 artefacts that already live in a system (Identity provider / directory); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Initial passwords identical or built from a predictable pattern across new starters
Credentials held with a fast unsalted hash or reversibly encrypted in legacy components
Technically unavoidable deviations accepted without the required risk analysis and compensating measures

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

IDM-07 Access to cloud customer data · IDM-09 Authentication mechanisms