Check your readiness
Section A5 · Danzell 2026

Cyber Essentials A5 questions: secure configuration

The A5 questions test control 2: unused software and accounts, default passwords, external service authentication, auto-run and device locking.

Updated 22 September 2026
Short answer

Section A5 tests secure configuration. It asks whether unnecessary software and accounts are removed, default passwords changed, externally facing services authenticated and protected from brute force, auto-run disabled, and devices locked with a credential, such as a PIN or password of at least 6 characters.

Key facts
Questions
10 (A5.1 to A5.10)
Auto-fails
None
CE Plus test
No dedicated test case in the CE Plus specification v3.2

What questions are in section A5?

Section A5 has 10 questions, A5.1 to A5.10, none of them automatic fails. Each page gives the exact wording, what a compliant answer looks like and a model answer.

  1. A5.1NotesHave you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?
  2. A5.2Yes/NoHave you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?
  3. A5.3Yes/NoHave you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based a…
  4. A5.4Yes/NoDo you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?
  5. A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Conditional: if yes to question A5.4
  6. A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Conditional: if yes to A, B or C on question A5.4
  7. A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Conditional: if yes to question A5.4
  8. A5.8Yes/NoHave you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?
  9. A5.9Yes/NoWhen a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?
  10. A5.10NotesWhich method do you use to unlock the devices?Conditional: if yes to Question A5.9

How do assessors mark section A5?

Assessors read section A5 as a whole and against the scope inventory in A2: every answer must be true across the whole scope and consistent with the rest of the submission.

What they look for
A5.1 and A5.10 are notes questions that are commonly returned with a query. For A5.1 the assessor wants a repeatable method (build image, MDM baseline, quarterly review) rather than 'we uninstall things we don't need'. For A5.10 name the method per device type: 'Windows Hello PIN of 6 digits with lockout at 10 attempts on laptops; Face ID with 6-digit passcode fallback on iPhones'. Numbers matter: 4-digit PINs fail.
Common failure: The 4-digit phone PIN
An organisation enrols phones in MDM but leaves the passcode policy at the platform default of 4 digits. A5.10 is marked non-compliant because unlocking credentials must be at least 6 characters. Fix: push a passcode policy requiring a minimum of 6 characters and a wipe or lockout after 10 failed attempts, then re-answer with the policy name.

Related requirements

Frequently asked questions

10, from A5.1 to A5.10. 4 of them are conditional and only appear depending on an earlier answer.

No. None of the A5 questions is an auto-fail, but unclear or contradictory answers are returned by the assessor for more information.

5 Yes/No, 3 notes and 2 multiple choice questions.

At least 6 characters where the credential is only used to unlock the device. If the same PIN or password also authenticates the user to organisational services, the full password rules apply: 12 characters, or 8 with MFA, or 8 with a deny list. Biometrics are allowed as the unlock method with a PIN or password as fallback.

The requirements document does not set a specific timeout. It requires a locking mechanism that needs a credential before access and protection against brute force. A5.9 asks whether a locking mechanism is set on devices that require the user in hand. A short automatic lock is good practice and easy to enforce by policy.

Macros that execute when a document opens are a form of automatic file execution without user authorisation, so they should be blocked by default. Microsoft documents that VBA macros in files from the internet are blocked by default in Microsoft 365 Apps on Windows; confirm the policy is applied across your tenant and mention it in A5.8.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources