A5.10: Which method do you use to unlock your devices?
Which method do you use to unlock the devices?
Source: IASME Cyber Essentials Danzell question set v16.3
A compliant A5.10 answer names the unlock method for each type of device, such as biometric, PIN or password, the minimum length, and the brute-force protection. A PIN or password used only to unlock a device must be at least 6 characters. If the same credential also signs in to accounts, the full password rules apply.
Is A5.10 an automatic fail?
No. A5.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Notes a notes question, answered in free text
- IASME guidance
- Please refer to Device Unlocking Credentials paragraph found under Secure Configuration in the Cyber Essentials Requirements for IT Infrastructure document for further information.
- Logic
- If yes to Question A5.9.
- Requirement enforced
- Secure Configuration: Ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.9A6.1Back to the secure configuration control
What does A5.10 ask?
A5.10 asks: “Which method do you use to unlock the devices?”
A5.10 appears if you answered Yes to A5.9 and asks which method you use to unlock your devices. The guidance points to the device unlocking credentials paragraph under secure configuration in v3.3.
That paragraph says: where a device requires the user's physical presence, a credential such as a biometric, password or PIN must be in place before the user can access its services. The method must be protected against brute force by throttling (no more than 10 guesses in 5 minutes) or locking after no more than 10 unsuccessful attempts, or the vendor default where neither can be configured. Technical controls must manage credential quality: at least 6 characters for a credential used only to unlock, and the full password requirements where it is also used for authentication. Windows Hello PINs and phone passcodes are the common cases.
What should you write in the notes field for A5.10?
Write two to four specific sentences for A5.10: what you do, who owns it, how often it happens and the record that proves it.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
Windows laptops: Windows Hello [face or fingerprint] with a PIN fallback of at least 6 digits, enforced by [Intune]; the device locks after [10] failed attempts. Windows sign-in passwords follow A7.11 (at least 12 characters). Macs: Touch ID with a password of at least [12] characters, enforced by [MDM]. iPhones and Android phones (corporate and BYOD): Face ID, fingerprint or a passcode of at least 6 digits, enforced by [Intune compliance policy]; the vendor's default lockout and erase settings apply after repeated failures.
Why do applicants fail A5.10?
A common reason applicants fail A5.10: a 4-digit PIN allowed on phones or Windows Hello.
- No mention of brute-force protection on the unlock method.
- Describing user sign-in passwords only, and not phones and tablets.
- BYOD devices not covered by any enforcement.
How do you fix a failing A5.10 answer?
If your answer to A5.10 would not pass today, fix the control first and then write the answer. In order:
- Set a minimum PIN or passcode length of 6 for unlock-only credentials in your MDM compliance policies.
- Turn on lockout or throttling at 10 failed attempts or fewer, or rely on the vendor default where it cannot be changed.
- Where the unlock credential is also the account password, apply the full password rules from A7.11.
- Describe each device type, method, minimum length and lockout in the notes.
How do assessors check A5.10?
What evidence should you keep for A5.10?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.10:
- The MDM or Intune compliance policy showing minimum PIN or password length and lockout settings.
Where to go next
- Device unlockingThe 6-character rule
- BiometricsGlossary
- iOS and iPadOS setupSetup guide
- Android setupSetup guide
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
Other A5 questions
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Notes
- A5.7A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Options A to C
- A5.8A5.8Yes/NoHave you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?Yes/No
- A5.9A5.9Yes/NoWhen a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?Yes/No
Frequently asked questions
A5.10 in the 2026 Danzell Cyber Essentials question set asks: "Which method do you use to unlock the devices?" It is a notes question, answered in free text.
A compliant A5.10 answer names the unlock method for each type of device, such as biometric, PIN or password, the minimum length, and the brute-force protection. A PIN or password used only to unlock a device must be at least 6 characters. If the same credential also signs in to accounts, the full password rules apply.
No. A5.10 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
At least 6 characters for a PIN or password used only to unlock a device. If the same credential also authenticates the user to accounts, the full password requirements apply.
Yes, as a device unlocking credential. Microsoft documents that a Windows Hello PIN is tied to the device it was set up on, so the v3.3 rule for credentials used just to unlock a device applies: at least 6 characters, with brute-force protection. If the same PIN or password is also used to sign in to accounts, the full password requirements apply instead.
Throttling that allows no more than 10 guesses in 5 minutes, or locking after no more than 10 unsuccessful attempts. If the vendor does not allow either to be configured, use the vendor's default.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh