Standard user account
A standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval. Cyber Essentials expects daily work, including email and browsing, to happen in one (A7.6, A7.7). Cyber Essentials Plus test case 5 checks a standard user cannot run admin tasks without a separate login.
- Term
- Standard user account
- Also known as
- Standard user, Non-admin account, Normal user account
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term standard user account mean in Cyber Essentials?
A standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
How does standard user account apply to Cyber Essentials?
In plain terms
A standard user is like a member of staff who can use all the office equipment but has to ask the office manager before fitting a new lock or rewiring a socket. On a laptop that means you can write documents, send email and browse the web, but installing a new program or changing security settings asks for an administrator's name and password first.
What Cyber Essentials asks
The NCSC requirements say you must "use separate accounts to perform administrative activities only (no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks)". The worked example in the requirements shows why: ransomware opened from an admin account "was able to encrypt far more data than would have been possible with standard user privileges".
A7.6 asks how you make sure separate accounts are used for admin tasks, and A7.7 asks how you stop admin accounts being used for email and browsing. The A7.7 guidance adds that "Software and update downloads should be performed as a standard user and then installed as an administrator", and that good policy and training can be enough to achieve this.
What an assessor looks for
At Cyber Essentials Plus, test case 5 is run on every sampled device: a user logged in with their normal account tries to run an admin process. It passes if they are "prompted for an additional login and the process does not run using the user account details". If every member of staff is a local administrator on their own laptop, there is no standard account to test and the check fails.
See CE Plus test 5 and A7.6. Related: administrator account, User Account Control, least privilege.
Related terms
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- User Account Control (UAC)User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.
- Least privilegeLeast privilege is the rule that each person gets only the access they need to do their current job, and nothing more.
- ThrottlingThrottling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
- Windows LAPSLAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
Frequently asked questions
A standard user account is an everyday login that can run programs and open files but cannot install software or change system-wide settings without an administrator's approval.
In the 2026 Danzell question set, standard user account comes up at A7.6, A7.7. Read those questions against the definition above so your answers use the term the way the assessor will.
Standard user account relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.