A8.4: Are users prevented from installing unsigned applications?
If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
If you selected option B in A8.1, answer Yes to A8.4 only if users on every relevant device can install only signed applications, typically from an app store. iPhones and iPads restrict unsigned apps unless jailbroken. Android allows installs from unknown sources unless that is blocked, so block sideloading through MDM and make sure no device is jailbroken or rooted.
Is A8.4 an automatic fail?
No. A8.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- Some operating systems which include Windows, Chromebooks, mobile phones and tablets restrict you from installing unsigned applications. Usually you have to "root" or "jailbreak" a device to allow unsigned applications.
- Requirement enforced
Only approved applications, restricted by code signing, are allowed to execute on devices.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A8.3A8.5Back to the malware protection control
What does A8.4 ask?
A8.4 asks: “If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?”
A8.4 asks, where you use an app store or application signing, whether users are restricted from installing unsigned applications. The guidance says some operating systems, including Windows, Chromebooks, mobile phones and tablets, restrict installation of unsigned applications, and that you usually have to root or jailbreak a device to allow them.
The requirement: only approved applications, restricted by code signing, are allowed to execute on devices. On Android, check that installation from unknown sources is blocked. See jailbreaking and rooting, mobile device management and the Android and iOS setup guides.
What must be true to answer Yes to A8.4?
You can answer Yes to A8.4 only when all of the following are true today, across every device, user and cloud service in scope.
- Phones and tablets install apps only from the official app stores or your MDM.
- Android installation from unknown sources is blocked by MDM or work profile policy.
- Jailbroken or rooted devices are detected and blocked from organisational data.
- BYOD devices in scope meet the same conditions, for example through an app protection or compliance policy.
Why do applicants fail A8.4?
A common reason applicants fail A8.4: android devices with 'install unknown apps' allowed.
- No way to detect a jailbroken or rooted device.
- Selecting option B for Windows laptops without code signing enforcement.
- BYOD devices with no policy at all.
How do you fix a failing A8.4 answer?
If your answer to A8.4 would not pass today, fix the control first and then write the answer. In order:
- Block installs from unknown sources on Android through MDM or work profile policy.
- Set compliance rules that block jailbroken or rooted devices from organisational data.
- Apply app protection or compliance policies to BYOD phones in scope.
How do assessors check A8.4?
What evidence should you keep for A8.4?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A8.4:
- The MDM restriction blocking unknown sources and jailbroken or rooted devices.
Where to go next
- Jailbreaking and rootingGlossary
- Android setupSetup guide
- iOS and iPadOS setupSetup guide
- Mobile device managementGlossary
- CE Plus test 3: malware protectionTest files by email and browser
- Malware Protection requirementsThe control this question tests
- All A8 questionsMalware protection
- Cyber Essentials checklistThe evidence to gather for every question
Other A8 questions
- A8.1A8.1Multiple choice + notesAre all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:Multiple choice + notes
- A8.2A8.2Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?Yes/No
- A8.3A8.3Yes/NoIf Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?Yes/No
- A8.5A8.5Yes/NoIf Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain t…Yes/No
Frequently asked questions
A8.4 in the 2026 Danzell Cyber Essentials question set asks: "If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?" It is a Yes/No question.
If you selected option B in A8.1, answer Yes to A8.4 only if users on every relevant device can install only signed applications, typically from an app store. iPhones and iPads restrict unsigned apps unless jailbroken. Android allows installs from unknown sources unless that is blocked, so block sideloading through MDM and make sure no device is jailbroken or rooted.
No. A8.4 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes, unless jailbroken. iOS only runs signed apps from the App Store or an approved enterprise channel. Make sure devices are not jailbroken.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh