Service account
A service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files. Cyber Essentials does not mention service accounts by name, but its rules that every account authenticates, is approved and is removed when no longer needed still apply to them.
- Term
- Service account
- Also known as
- Non-human account, System account, Application account
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term service account mean in Cyber Essentials?
A service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
How does service account apply to Cyber Essentials?
In plain terms
A service account is like a key held by your cleaning contractor rather than a member of staff. No person logs in with it day to day, but it still opens doors. Backup software, scanners that save to a shared folder, and links between your accounting package and your bank feed often run under accounts like this.
What Cyber Essentials asks
The scheme does not have separate rules for service accounts. The general user access control rules apply to every account your organisation owns:
- "All user accounts require the user to authenticate."
- You must "have in place a process to create and approve user accounts".
- You must "remove or disable user accounts when they're no longer required".
- Default or guessable passwords must be changed (A5.3), and the password rules for quality and brute-force protection apply to password-based logins.
If a service account holds admin rights, it is also privileged access. The requirements say special access privileges must be removed or disabled when no longer required, and A7.8 asks you to track who has administrator accounts.
Practical points
Keep a short list of service accounts: what each one does, who owns it and what access it has. When you retire a piece of software, disable its account too, which is the point of A5.2 on unnecessary accounts. Where a supplier set the account up, it is still yours: the requirements say accounts your organisation owns are in scope even when a third party uses them.
See the user access control requirements. Related: user account, privileged access, shared account.
Related terms
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Shared accountA shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
- Single sign-on (SSO)Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
- SMS verification codesSMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
Frequently asked questions
A service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
Service account relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.