A5.1: How do you remove software and services you do not use?
Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? Describe how you achieve this.
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A5.1 answer describes how you remove or disable applications, system utilities and network services that are not needed day to day, on laptops, desktops, thin clients, servers, tablets, phones and cloud services. Say who does it, how often, which tool or standard build enforces it, and how unused cloud features are switched off.
Is A5.1 an automatic fail?
No. A5.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- You must remove or disable applications, system utilities and network services that are not needed in day-to-day use. You need to check your cloud services and disable any services that are not required for day-to-day use.
- Requirement enforced
You must regularly remove or disable unnecessary software (including applications, system utilities and network services).
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A4.11A5.2Back to the secure configuration control
What does A5.1 ask?
A5.1 asks: “Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? Describe how you achieve this.”
A5.1 asks whether you have removed or disabled software and services you do not use, across laptops, desktops, thin clients, servers, tablets, mobile phones and cloud services, and asks you to describe how. The guidance says you must remove or disable applications, system utilities and network services not needed in day-to-day use, and check your cloud services to disable anything not required.
The requirement behind it: you must regularly remove or disable unnecessary software, including applications, system utilities and network services. The guidance points to where to look: Apps and Features on Windows, the Applications folder on macOS, and the package manager on Linux. Unused software is also unpatched software, which matters for A6.5. See unnecessary software.
What should you write in the notes field for A5.1?
Write two to four specific sentences for A5.1: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
New laptops are built from a standard [Intune Autopilot] profile that removes pre-installed trial software and consumer apps. Users are standard users and cannot install software (A7.6). [Role] reviews the installed software report in [Intune / RMM] [monthly] and uninstalls anything not on the approved list. Servers run only the roles they need; unused services are disabled at build. In Microsoft 365, unused services such as [legacy authentication, third-party app consent] are turned off, and unused integrations in other cloud services are reviewed at the same time.
Why do applicants fail A5.1?
A common reason applicants fail A5.1: a one-line 'we remove unused software' with no owner, frequency or tool.
- Manufacturer bloatware and trial antivirus left on new laptops.
- Ignoring cloud services: unused apps, connectors and third-party integrations left enabled.
- Old remote access tools from a previous IT provider still installed.
How do you fix a failing A5.1 answer?
If your answer to A5.1 would not pass today, fix the control first and then write the answer. In order:
- Build new devices from a standard image or Autopilot profile that removes trial and consumer software.
- Run an installed software report from your MDM or RMM, compare it with your approved list and uninstall the rest.
- Disable unused server roles and network services.
- Review cloud services for unused apps, connectors and third-party integrations and turn them off.
How do assessors check A5.1?
What evidence should you keep for A5.1?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.1:
- The standard build or Autopilot profile, and a recent installed software report.
Where to go next
- Unnecessary softwareGlossary
- Microsoft Intune setupSetup guide
- Windows 11 setupSetup guide
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.2A5.2Yes/NoHave you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?Yes/No
- A5.3A5.3Yes/NoHave you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based a…Yes/No
- A5.4A5.4Yes/NoDo you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?Yes/No
- A5.5A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Options A to E
Frequently asked questions
A5.1 in the 2026 Danzell Cyber Essentials question set asks: "Have you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services? Describe how you achieve this." It is a notes question, answered in free text.
A compliant A5.1 answer describes how you remove or disable applications, system utilities and network services that are not needed day to day, on laptops, desktops, thin clients, servers, tablets, phones and cloud services. Say who does it, how often, which tool or standard build enforces it, and how unused cloud features are switched off.
No. A5.1 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Any application, system utility or network service not needed in day-to-day use: trial software, consumer apps, unused remote access tools, unused server roles and unused cloud features or integrations.
Yes. A5.1 names cloud services, and the guidance says to check them and disable any services not required for day-to-day use.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh