User account
A user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service. Cyber Essentials requires an approval process before accounts are created (A7.1), unique credentials for every account (A7.2) and prompt removal when someone leaves (A7.3).
- Term
- User account
- Also known as
- Login, User login, Account
- Category
- Accounts and access
- Requirement area
- 4. User Access Control; 2. Secure Configuration
- Reviewed against
- Requirements v3.3
What does the term user account mean in Cyber Essentials?
A user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
How does user account apply to Cyber Essentials?
In plain terms
A user account is like a named staff pass. It tells the computer or service who you are and what you are allowed to open. Your Windows login, your Microsoft 365 or Google Workspace email login and your login to the accounting package are all user accounts. So are the accounts your outside IT support company uses to look after your systems.
What Cyber Essentials asks
The user access control section of the NCSC requirements says your organisation "must be in control of your user accounts and the access privileges that allow access to your organisational data and services", and that this "also includes third party accounts". The scope section adds that all accounts your organisation owns are in scope, even when a supplier or managed service provider uses them. In the question set that becomes:
- A7.1: a process to create and approve accounts, with approval from someone in a leadership role
- A7.2: unique credentials for every account, with no sharing
- A7.3: accounts deleted or disabled when staff leave
- A7.4: only the access each person needs for their current job
Secure configuration adds A5.2: devices and cloud services should only contain accounts that are needed and regularly used. Guest accounts and admin accounts nobody uses should be removed or disabled.
What an assessor looks for
A7.1 and A7.3 are written answers, so describe the real process: who asks for a new account, who approves it and who switches it off on a leaver's last day. Accounts belonging to former staff or old suppliers that were never disabled are exactly what A5.2 and A7.3 are there to catch.
See the user access control requirements and A7.3. Related: administrator account, shared account, joiners, movers and leavers.
Related terms
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Shared accountA shared account is a single login that more than one person uses, such as one office email login whose password the whole team knows.
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
- User Account Control (UAC)User Account Control (UAC) is the Windows feature that asks for permission, or for an administrator's password, before a program can make changes that affect the whole computer.
- Windows LAPSLAPS is a Microsoft feature built into Windows that gives the local administrator account on every PC its own random password, changes it automatically and stores it securely.
- Account lockoutAccount lockout is a setting that blocks further login attempts after a set number of wrong passwords or PINs, so a guesser cannot keep trying.
Frequently asked questions
A user account is the named login, usually a username plus a password or other credential, that lets one person into a computer, phone or online service.
In the 2026 Danzell question set, user account comes up at A5.2, A7.1, A7.2, A7.3. Read those questions against the definition above so your answers use the term the way the assessor will.
User account relates to 4. User Access Control; 2. Secure Configuration in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.