Auto-run (AutoRun and AutoPlay)
Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes. Cyber Essentials requires any auto-run feature that executes files without user authorisation to be disabled. A5.8 asks whether you have done this, and a prompt asking the user what to do is acceptable.
- Term
- Auto-run
- Also known as
- AutoRun, AutoPlay, Autorun
- Category
- Devices and software
- Requirement area
- 2. Secure Configuration
- Questions
- A5.8
- Reviewed against
- Requirements v3.3
What does the term auto-run mean in Cyber Essentials?
Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes.
disable any auto-run feature which allows file execution without user authorisation (such as when they are downloaded)
How does auto-run apply to Cyber Essentials?
In plain terms
Imagine a reception desk that opens every parcel the moment it arrives. Most parcels are harmless, but one day one of them is a trap. Auto-run is that automatic opener. It was designed for convenience, such as starting a program as soon as you insert a disc, but it also lets a malicious file on a USB stick or in a download run before anyone has a chance to stop it.
What Cyber Essentials asks
The secure configuration requirement is quoted above. A5.8 asks: "Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?"
The IASME guidance allows a middle ground: "It is acceptable to choose the option where a user is prompted to make a choice about what action will occur each time they insert a memory stick. If you have chosen this option, you can answer yes to this question."
Common mistakes
- Changing the setting on one laptop by hand. Setting it once, centrally, through Group Policy or MDM covers every device and is easier to show.
- Forgetting downloads. The NCSC names files "downloaded" as an example, so check that browsers are not set to open downloaded files automatically.
- Overlooking macros. The scheme does not name them, but a macro that runs as soon as a document opens is the same kind of risk.
See the secure configuration requirements, question A5.8 and the Windows 11 setup guide. Related: macros, secure configuration.
Related terms
- MacrosA macro is a small program saved inside a document or spreadsheet that automates tasks, and it can run as soon as the file is opened.
- Secure configurationSecure configuration means changing the factory settings on computers, phones, servers and cloud services so they only do what the business needs and have no easy ways in.
- Browser extensionA browser extension is a small add-on program that adds a feature to a web browser, such as a password manager, ad blocker or PDF tool.
- BYOD (bring your own device)BYOD, short for bring your own device, means staff using their own personal phones, tablets or computers to do work.
- CVE (Common Vulnerabilities and Exposures)A CVE is a unique public reference number given to a known security flaw, so vendors, scanners and IT teams can all refer to the same problem.
- CVSS (Common Vulnerability Scoring System)CVSS, the Common Vulnerability Scoring System, is the 0 to 10 scale Cyber Essentials uses to define critical and high-risk vulnerabilities.
Frequently asked questions
Auto-run is a feature that opens or runs a file automatically, without asking, for example when a USB stick is plugged in or a download finishes. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, auto-run comes up at A5.8. Read those questions against the definition above so your answers use the term the way the assessor will.
Auto-run relates to 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.