Throttling
Throttling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless. Cyber Essentials accepts it as brute-force protection if it allows no more than 10 guesses in 5 minutes. It sits alongside account lockout and MFA as the options at A7.10 and A5.7, and also covers device unlocking.
- Term
- Throttling
- Also known as
- Login throttling, Rate limiting, Progressive delay
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term throttling mean in Cyber Essentials?
Throttling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless.
‘throttling' the rate of attempts, so that the length of time the user must wait between attempts increases with each unsuccessful attempt. You should allow no more than 10 guesses in 5 minutes
How does throttling apply to Cyber Essentials?
In plain terms
You have probably seen it on a phone: after a few wrong PINs it says "try again in 1 minute", then 5 minutes, then longer. Nobody is locked out for good, but guessing becomes so slow that a criminal cannot get through enough attempts to succeed.
What Cyber Essentials asks
The NCSC requirements describe throttling in the wording quoted above. It is one of three ways to protect passwords against brute-force guessing, alongside MFA and locking after no more than 10 unsuccessful attempts. The same wording appears in the device unlocking rules, which cover biometrics, passwords and PINs on laptops, phones and tablets. Where the vendor does not let you configure throttling or lockout, you use the vendor's default setting.
In the question set:
- A7.10 asks how systems that use passwords are protected from brute-force attacks. Throttling is a valid answer.
- A5.7 asks how external services you host are protected when MFA is not used. Option A is "Throttling the rate of attempts".
- A5.10 asks how devices are unlocked, where built-in throttling on phones and tablets is relevant.
What an assessor looks for
The limit, not just the word. Say where throttling is set and confirm it allows no more than 10 guesses in 5 minutes. If a system only offers a fixed delay that still permits more guesses than that, use lockout or MFA instead.
See how passwords must be protected against brute force and A7.10. Related: account lockout, brute-force attack, device unlocking.
Related terms
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
- Brute-force attackA brute-force attack is an attempt to get into an account by guessing passwords over and over, usually with software that tries thousands of combinations automatically.
- Device unlockingDevice unlocking is the check, such as a PIN, password, fingerprint or face scan, that a person must pass before they can use a laptop, phone or tablet.
- User accountA user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
- User Account Control (UAC)User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.
- Windows LAPSLAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
Frequently asked questions
Throttling is a setting that makes you wait longer after each wrong password or PIN, so guessing becomes slow enough to be pointless. The definition follows the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3.
In the 2026 Danzell question set, throttling comes up at A5.7, A5.10, A7.10. Read those questions against the definition above so your answers use the term the way the assessor will.
Throttling relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.