Privileged access
Privileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data. Cyber Essentials calls these special access privileges. They must be removed when no longer required, for example after a change of role, and admin access is reviewed under A7.9.
- Term
- Privileged access
- Also known as
- Special access privileges, Elevated privileges, Admin rights
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term privileged access mean in Cyber Essentials?
Privileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
Compared to normal user accounts, accounts with special access privileges have enhanced access to devices, applications and information.
How does privileged access apply to Cyber Essentials?
In plain terms
Think of a finance system where most staff can view invoices but only two people can approve payments. The two approvers have privileged access. In IT the most common form is administrator rights: the power to install software, change security settings or create and delete accounts. The more of it people hold, the more damage one stolen login can do.
What Cyber Essentials asks
The NCSC requirements describe these accounts as quoted above and warn that if they are compromised, an attacker could "corrupt information on a large scale, disrupt business processes or gain unauthorised access to other devices in the organisation". Your organisation must "remove or disable special access privileges when no longer required (when a member of staff changes role, for example)".
The Danzell question set describes special access as "privileges over and above those of normal users" and says working day to day in administrator mode is not acceptable. The questions that cover it:
- A7.4: staff only have the access privileges they need for their current job
- A7.5: a formal process for granting administrator-level access
- A7.8: a record of who has administrator accounts
- A7.9: a regular review of who should keep admin access
The guidance for A7.6 also points to the NCSC's material on "just enough" and "just in time" access.
What an assessor looks for
A named list of people with privileged access, including accounts used by your IT supplier, and evidence that someone reviews it. Accounts used by third parties are in scope when your organisation owns them.
See least privilege and admin approval and A7.9. Related: administrator account, least privilege, joiners, movers and leavers.
Related terms
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Least privilegeLeast privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
- Shared accountA shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
- Single sign-on (SSO)Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
Frequently asked questions
Privileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, privileged access comes up at A7.4, A7.5, A7.8, A7.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Privileged access relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.