| CCC.IAM.CP01 | Global Identities | The service always manages identities in a single global namespace, so an identity and its credentials are valid in every region without regional configuration. | 1 |
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. | 8 |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. | 4 |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. | 4 |
| CCC.IAM.CP05 | IAM Groups | The service can create, list, modify and delete groups of identities so that permissions assigned to the group apply to every member. | 2 |
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. | 7 |
| CCC.IAM.CP07 | Managed Identities | The service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials. | 2 |
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. | 4 |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. | 4 |
| CCC.IAM.CP10 | Custom Roles | The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines. | 4 |
| CCC.IAM.CP11 | Resource-Level Access | The service can scope a permission grant to specific resources or resource hierarchies rather than to the entire service. | 1 |
| CCC.IAM.CP12 | Policy Conditions | The service can attach conditions to a permission grant so that the grant applies only when attributes of the request, principal or resource match. | 2 |
| CCC.IAM.CP13 | Temporary Credentials | The service can issue short-lived credentials for a session or task that expire automatically after a defined duration. | 2 |
| CCC.IAM.CP14 | Multi-Factor Authentication | The service may be configured to require a second authentication factor when a user signs in, and can require that MFA was used as a condition on sensitive actions. | 1 |
| CCC.IAM.CP15 | Role Assumption and Delegation | The service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session. | 4 |
| CCC.IAM.CP16 | Access Boundaries | The service may be configured with a boundary that caps the maximum effective permissions an identity can hold, regardless of the permissions granted to it. On providers without this feature, delegated permission grants have no upper bound. | 1 |
| CCC.IAM.CP17 | Deny Permissions by Default | The service always denies access to every resource unless a permission has been explicitly granted to the requesting identity. | 1 |
| CCC.IAM.CP18 | Audit Tooling | The service can simulate or analyze the permissions an identity holds or has used, and can report which identities have access to a resource and whether that access is exercised. | 2 |
| CCC.IAM.CP19 | Long-Term Credential Expiry | The service may be configured to set a maximum lifetime on a long-term credential so that it stops working automatically once that lifetime is reached. On providers without this feature for a credential type, the credential remains valid until it is rotated or deleted. | 1 |