A5.2: Do your devices and cloud services contain only necessary user accounts?
Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?
Compliant answerYes
Source: IASME Cyber Essentials Danzell question set v16.3
Answer Yes to A5.2 only if every laptop, computer, server, tablet, mobile device and cloud service contains just the accounts needed and regularly used for your business. Guest accounts, unused default admin accounts, leavers' accounts and test accounts must be removed or disabled. Check local device accounts as well as your directory and every cloud service.
Is A5.2 an automatic fail?
No. A5.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Compliant answer
- Yes
- Answer type
- Yes/No a Yes/No question
- IASME guidance
- You must remove or disable any user accounts that are not needed in day-to-day use on all devices and cloud services.
- Requirement enforced
You must regularly remove and disable unnecessary user accounts (such as guest accounts and administrative accounts that won’t be used).
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.1A5.3Back to the secure configuration control
What does A5.2 ask?
A5.2 asks: “Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?”
A5.2 asks whether all your devices and cloud services only contain necessary user accounts that are regularly used in the course of your business. The guidance says you must remove or disable any accounts not needed day to day on all devices and cloud services, and shows where to check: Computer Management on Windows, Users and Groups on macOS, and /etc/passwd on Linux.
The requirement behind it: you must regularly remove and disable unnecessary user accounts, such as guest accounts and administrative accounts that will not be used. Leavers are covered in more detail by A7.3.
What must be true to answer Yes to A5.2?
You can answer Yes to A5.2 only when all of the following are true today, across every device, user and cloud service in scope.
- Built-in guest accounts are disabled on every device.
- Default or vendor admin accounts that are not used are disabled, renamed or removed.
- Leavers' and test accounts have been removed from the directory and from every cloud service in A2.9.
- Someone reviews accounts on a schedule and can show the last review.
Why do applicants fail A5.2?
A common reason applicants fail A5.2: accounts for people who left months ago still active in a SaaS tool outside single sign-on.
- Shared or generic accounts ('reception', 'warehouse') nobody owns.
- Old MSP engineer accounts left in the tenant.
- Local admin accounts created during setup and never removed.
How do you fix a failing A5.2 answer?
If your answer to A5.2 would not pass today, fix the control first and then write the answer. In order:
- Review local accounts on each device type and disable guest accounts and unused default admin accounts.
- Export users from your directory and every cloud service in A2.9; remove leavers, test accounts and old MSP accounts.
- Give every shared or generic account an owner, or replace it with named accounts.
- Set a recurring review, monthly or quarterly, and record it.
How do assessors check A5.2?
What evidence should you keep for A5.2?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.2:
- A recent account review of the directory and the main cloud services, with any accounts removed.
Where to go next
- User accountGlossary
- Shared accountGlossary
- Microsoft 365 and Entra ID setupSetup guide
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.1A5.1NotesHave you removed or disabled software and services that you do not use on your laptops, desktop computers, thin clients, servers, tablets, mobile phones and cloud services?Notes
- A5.3A5.3Yes/NoHave you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based a…Yes/No
- A5.4A5.4Yes/NoDo you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?Yes/No
- A5.5A5.5Options A to EIf yes to question A5.4, which authentication option do you use?Options A to E
Frequently asked questions
A5.2 in the 2026 Danzell Cyber Essentials question set asks: "Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?" It is a Yes/No question.
Answer Yes to A5.2 only if every laptop, computer, server, tablet, mobile device and cloud service contains just the accounts needed and regularly used for your business. Guest accounts, unused default admin accounts, leavers' accounts and test accounts must be removed or disabled. Check local device accounts as well as your directory and every cloud service.
No. A5.2 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Yes. v3.3 names guest accounts as an example of unnecessary accounts to remove or disable. It is disabled by default on current Windows versions; confirm it has not been turned on.
The requirement says 'regularly'. A monthly or quarterly review of the directory and cloud services, plus immediate removal for leavers, is what most assessors expect to see.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh