Cyber Essentials Plus Test 5: account separation

What does Test 5 check?

Test 5 checks that a standard user account cannot run an administrative task without being prompted for a separate login, so that the process does not run with the user's own account.

The requirements say you must use separate accounts to perform administrative activities only, with no emailing, web browsing or other standard activity on them. The reason is in the requirements' own example: malware runs with the privilege of the account that opened it, and an administrator opening a malicious attachment lets ransomware encrypt far more than a standard user could.

A7.6 and A7.7 ask how you ensure separation and how you prevent administrator accounts being used for everyday tasks. Test 5 checks the first half on every sampled device.

What administrative process is attempted?

The assessor attempts any action that needs administrator rights from the sampled user's account. The specification does not prescribe which action.

The specification leaves the exact process to the assessor and the operating system. The intent is an action that requires elevated rights, so that the outcome shows whether the current account holds them.

Why is a UAC prompt alone not enough?

A UAC prompt alone is not enough because the pass condition also requires that the process does not run using the user's own account details. A Yes button on an account that is already an administrator fails.

The pass condition has two parts: the user is prompted for an additional login, and the process does not run using the user's own account details. A Windows account that is a local administrator will see a User Account Control prompt, but clicking 'Yes' runs the process with that same account. That is a fail. The prompt must demand different credentials that the user does not hold.

The same logic applies to macOS users who are administrators of their own Mac: the password dialog appears, they type their own password, and the installer runs. Separation means the everyday account cannot elevate at all.

How do you pass Test 5?

• Remove every daily-use account from the local Administrators group on Windows and from the admin group on macOS. Use a management tool to enforce it rather than relying on manual clean-up.
• Create named administrator accounts for the people who need them (A7.5), used only for administrative tasks, and keep a register of who holds them (A7.8) with a periodic review (A7.9).
• Where staff genuinely need to install software, use a privilege management tool or a self-service portal so elevation happens with a separate identity, not their own.
• In cloud tenants, keep administrator roles on separate accounts from the accounts used for email, and require MFA on both.
• Test it: log in as an ordinary user on each build and try to install something. If your own password gets you through, the device will fail.

How do assessors check this?