Account lockout
Account lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying. It is one of three accepted brute-force protections in Cyber Essentials: lock after no more than 10 unsuccessful attempts. The others are throttling and MFA. It comes up at A5.7, A7.10 and A5.10.
- Term
- Account lockout
- Also known as
- Lockout policy, Account lockout threshold, Device lockout
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term account lockout mean in Cyber Essentials?
Account lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
locking devices after no more than 10 unsuccessful attempts
How does account lockout apply to Cyber Essentials?
In plain terms
It is the same idea as a cash machine that keeps your card after too many wrong PINs. After a set number of failed attempts the account or device stops accepting guesses, either for a period of time or until someone unlocks it.
What Cyber Essentials asks
The NCSC requirements list lockout as one of three ways to protect passwords against brute-force guessing, in the wording quoted above. The other two are MFA and throttling. The same options appear in the device unlocking rules for biometrics, passwords and PINs, which add: "When the vendor doesn't allow you to configure the above, use the vendor's default setting."
In the question set:
- A7.10 asks how systems that use passwords are protected from brute-force attacks.
- A5.7 asks which option protects your external services when MFA is not used. Option B is "Locking accounts after 10 unsuccessful attempts".
- A5.10 asks which method unlocks your devices, which is where device lockout belongs.
Common mistakes
- A lockout threshold set higher than 10, such as 20 or 50 attempts.
- Lockout set on office laptops but not on an internet-facing service such as a remote access portal.
- No agreed way to unlock a locked account, which tempts people to switch lockout off.
See how passwords must be protected against brute force and A5.7. Related: throttling, brute-force attack, group policy.
Related terms
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- Group policyGroup policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
- Active Directory (AD)Active Directory is Microsoft's system, run on a Windows server in your own office or data centre, that holds the central list of staff logins, computers and permissions.
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Authenticator appAn authenticator app is a phone app that confirms it is really you logging in, either by showing a short code that changes every few seconds or by asking you to tap to approve.
Frequently asked questions
Account lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, account lockout comes up at A5.7, A5.10, A7.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Account lockout relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.