A2.10: Who is responsible for managing your IT systems?
Please provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment.
Source: IASME Cyber Essentials Danzell question set v16.3
A2.10 needs the name and role of the person responsible for managing the IT systems in scope. IASME's guidance says this person must be a member of your organisation and cannot be employed by your outsourced IT provider. If an MSP runs your IT day to day, name the internal person who owns the relationship and the decisions.
Is A2.10 an automatic fail?
No. A2.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- This person must be a member of your organisation and cannot be a person employed by your outsourced IT provider.
- Requirement enforced
- Section D of the requirements: the scope must cover the whole IT infrastructure or a well-defined and separately managed sub-set, and cloud services cannot be excluded.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
What does A2.10 ask?
A2.10 asks: “Please provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment.”
A2.10 asks for the name and role of the person responsible for managing your IT systems in scope. The guidance states that this person must be a member of your organisation and cannot be a person employed by your outsourced IT provider.
This matches the v3.3 position on third parties: all accounts your organisation owns are in scope even when an MSP uses them, and if you use externally managed services you must be able to confirm the controls are met. Ownership stays with you. See third-party accounts and MSPs.
What should you write in the notes field for A2.10?
Write two to four specific sentences for A2.10: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[Name], [Operations Director]. Day-to-day IT support is provided by [MSP name] under contract; [Name] approves changes, holds the admin account register and reviews the MSP's reports [monthly].
Why do applicants fail A2.10?
A common reason applicants fail A2.10: naming an engineer at the MSP, which the guidance does not allow.
- Naming a person who has left, or a generic mailbox.
- Naming someone with no authority over IT decisions.
- A name that does not match the person who can answer the assessor's follow-up questions.
How do you fix a failing A2.10 answer?
If your answer to A2.10 would not pass today, fix the control first and then write the answer. In order:
- Name an internal person, with their role, who owns IT decisions and the supplier relationship.
- If an MSP runs IT day to day, still name an internal person: the IASME guidance says this cannot be someone employed by your outsourced IT provider.
How do assessors check A2.10?
What evidence should you keep for A2.10?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A2.10:
- The named person's role and, where an MSP is used, the contract showing who approves changes.
Where to go next
- Third-party accounts and MSPsWho owns the controls
- Managed service providerGlossary
- Scope: what is in and outSection D of v3.3 explained
- Scope checklistBuild the A2 inventory
- All A2 questionsScope of assessment
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A2 questions
- A2.6.1A2.6.1NotesPlease list the quantity of thin clients within the scope of this assessment. Please include make and operating systems.Notes
- A2.7A2.7NotesPlease list the quantity of servers, virtual servers, virtual server hosts (hypervisors) and Virtual Desktop Infrastructure (VDI) servers. You must include the operating system.Notes
- A2.8A2.8NotesPlease list the quantities of tablets and mobile devices within the scope of this assessment.Notes
- A2.9A2.9NotesPlease list all the cloud services that are in use by your organisation and provided by a third party.Notes
Frequently asked questions
A2.10 in the 2026 Danzell Cyber Essentials question set asks: "Please provide the name and role of the person who is responsible for managing your IT systems in the scope of this assessment." It is a notes question, answered in free text.
A2.10 needs the name and role of the person responsible for managing the IT systems in scope. IASME's guidance says this person must be a member of your organisation and cannot be employed by your outsourced IT provider. If an MSP runs your IT day to day, name the internal person who owns the relationship and the decisions.
No. A2.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
No. IASME's A2.10 guidance says the person must be a member of your organisation and cannot be employed by your outsourced IT provider.
Name the person who owns the MSP relationship and approves IT decisions, often a director or office manager. They do not need to be technical.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh