A5.3: Have you changed all default passwords on your devices?

What does A5.3 ask?

A5.3 asks: “Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?”

A5.3 asks whether you have changed the default password for all user and administrator accounts on all your devices, in line with the password-based authentication requirements. The guidance says a password that is difficult to guess will be unique and will not use common or predictable words such as 'password' or 'admin', or number sequences such as '12345'.

The requirement behind it: regularly change any default or guessable account passwords, and use technical controls to manage password quality, through MFA, a minimum length of at least 12 characters with no maximum, or a minimum of at least 8 characters with no maximum plus automatic blocking of common passwords using a deny list. Password quality across the organisation is covered again in A7.11.

What must be true to answer Yes to A5.3?

You can answer Yes to A5.3 only when all of the following are true today, across every device, user and cloud service in scope.

• No device has an account with a vendor default or setup password, including printers' and servers' admin accounts.
• Local administrator passwords are unique per device, for example managed by Windows LAPS.
• Your directory or MDM enforces one of the three password quality options.
• Device passwords handed out at setup are changed by the user at first login.

Why do applicants fail A5.3?

A common reason applicants fail A5.3: one local administrator password shared across every laptop.

How do you fix a failing A5.3 answer?

If your answer to A5.3 would not pass today, fix the control first and then write the answer. In order:

1. Change every vendor or setup password on devices, printers, servers and appliances.
2. Deploy Windows LAPS or your MDM's equivalent so each device has a unique local admin password.
3. Enforce one of the three password quality controls in your directory or MDM: MFA, a 12-character minimum, or an 8-character minimum with a deny list.
4. Make new starters change their first password at first sign-in, or issue passwordless sign-in.

How do assessors check A5.3?

What evidence should you keep for A5.3?

The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.3:

• The password policy settings in Entra ID, Group Policy or MDM, and the LAPS configuration for local admin accounts.