Shared account
A shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows. Cyber Essentials does not allow them for devices, applications or cloud services. A7.2 asks whether every user and administrative account is accessed with unique credentials, and the guidance states that accounts must not be shared.
- Term
- Shared account
- Also known as
- Shared login, Generic account, Group account
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.2
- Reviewed against
- Requirements v3.3
What does the term shared account mean in Cyber Essentials?
A shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
How does shared account apply to Cyber Essentials?
In plain terms
A shared account is like a whole team signing the visitor book with the same name. Nobody can tell who came in or when. When one person leaves, the password has to be changed and passed round to everyone else, which is easy to forget. Common examples are one "reception" login on a front desk PC, one login for the firewall, or one admin account used by everyone at an IT support company.
What Cyber Essentials asks
The NCSC requirements say your organisation must "authenticate users with unique credentials before granting access to applications or devices". A7.2 asks: "Are all your user and administrative accounts accessed by entering unique credentials?" The guidance is direct: "You must ensure that no devices, applications or cloud services can be accessed without entering unique access credentials. Accounts must not be shared."
This includes accounts used by suppliers. The requirements state that all accounts your organisation owns are in scope, even when a third party such as a managed service provider uses them.
Common mistakes
- Treating a shared mailbox as a shared account. In Microsoft 365, people open a shared mailbox through their own login, so each person still has unique credentials.
- One admin login for the router or firewall known by several people.
- A generic login on a shop floor or warehouse PC. Each person needs their own account.
See can accounts be shared and A7.2. Related: user account, service account, password manager.
Related terms
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
- Service accountA service account is a login used by a program or automated process, rather than by a person, for example the account a backup tool uses to reach your files.
- Password managerA password manager is an app that stores all your passwords in one locked, encrypted place and can create strong new ones for you, so you only need to remember one.
- Single sign-on (SSO)Single sign-on (SSO) lets staff use one work login, such as their Microsoft or Google account, to get into many different apps instead of having a separate password for each.
- SMS verification codesSMS verification codes are one-time numbers sent to your mobile phone by text message, which you type in after your password to prove it is you.
- Standard user accountA standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
Frequently asked questions
A shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
In the 2026 Danzell question set, shared account comes up at A7.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Shared account relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.