A5.5: Which authentication option protects your externally facing services?
If yes to question A5.4, which authentication option do you use? A. Multi-factor authentication, with a minimum password length of 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length of 8 characters and no maximum length C. A minimum password length of 12 characters and no maximum length D. Passwordless, please describe E. None of the above, please describe
Source: IASME Cyber Essentials Danzell question set v16.3
A5.5 asks which control protects logins to the external service you declared in A5.4. Options A to D pass: MFA with a password of at least 8 characters, automatic blocking of common passwords with at least 8 characters, a 12-character minimum, or passwordless authentication you describe. Option E, none of the above, does not meet the requirement.
Is A5.5 an automatic fail?
No. A5.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
- Answer type
- Options A to E a multiple choice question with options A to E
- IASME guidance
- Acceptable technical controls that you can use to manage the quality of your passwords are outlined in the section about ‘Password-based authentication’ in the ‘Cyber Essentials Requirements for IT Infrastructure’ document.
- Logic
- If yes to question A5.4. Option A, B, C, D or E - option must be available to select all five options
- Requirement enforced
- Secure Configuration: Ensure that computers and network devices are properly configured to reduce vulnerabilities and provide only the services required to fulfil their role.
- Outcome if non-compliant
- May be returned for more information; not an automatic fail, but the requirement must still be met
- Related questions
- A5.4A5.6Back to the secure configuration control
What does A5.5 ask?
A5.5 asks: “If yes to question A5.4, which authentication option do you use? A. Multi-factor authentication, with a minimum password length of 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length of 8 characters and no maximum length C. A minimum password length of 12 characters and no maximum length D. Passwordless, please describe E. None of the above, please describe”
A5.5 only appears if you run or host an external service that gives access to non-public data across the internet (A5.4): a VPN server, a mail server, a customer portal or a SaaS product you provide. It asks which of the password-based authentication controls from the requirements document protects that service's logins.
The options are the same as A4.3 and A7.11. Option D is now 'passwordless' and needs a notes description; option E was added in the Danzell set and also needs notes.
If you use MFA the follow-up brute-force question A5.7 is satisfied by that MFA. If you choose B or C you must also answer A5.7 with throttling or lockout.
Which option should you choose for A5.5?
Choose the option for A5.5 that is enforced today across the whole scope, and complete the notes wherever the option requires them.
Option A: MFA on the service (for example a VPN with an authenticator app or certificate plus password of 8 or more characters). Option B: only if the service or identity provider blocks common passwords, such as Entra ID password protection. Option C: a 12-character minimum enforced in the application or directory. Option D: passkeys or certificate-based logins; describe them. Option E: not compliant.
A model answer to adapt. Replace everything in square brackets with your own facts, and delete anything that is not true.
[For option D] Users authenticate to [service] with [passkeys registered in Entra ID / client certificates issued by our PKI]; no password is entered. Fallback is [none / a 12-character password protected by lockout after 10 attempts]. [For A, B or C, notes optional] [Service] is protected by [Entra ID MFA via conditional access / a 12-character minimum enforced in the application]. Brute force is prevented by [MFA / lockout after 10 attempts], see A5.7. Passwords are changed on suspected compromise per A5.6.
Why do applicants fail A5.5?
A common reason applicants fail A5.5: answering Yes to A5.4 for a VPN and then choosing option C when the VPN actually accepts any 8-character password.
- Choosing option A because the corporate identity provider has MFA, while the external service uses its own local accounts without it.
- Forgetting that a customer portal you host is an external service and skipping A5.4 altogether.
- Option E with a note that says 'we plan to add MFA'.
How do you fix a failing A5.5 answer?
If your answer to A5.5 would not pass today, fix the control first and then write the answer. In order:
- For each external service, find the authentication it actually enforces.
- Turn on MFA where the service supports it and choose option A.
- Otherwise enforce a 12-character minimum (option C) or an 8-character minimum with a deny list (option B), and answer A5.7.
- For passwordless logins, describe the method and any fallback (option D).
How do assessors check A5.5?
What evidence should you keep for A5.5?
The self-assessment does not ask you to upload evidence, but the assessor can ask for clarification, a director signs the attestation, and Cyber Essentials Plus tests the same controls. Keep this on file for A5.5:
- The authentication settings for each external service: MFA policy, password length or deny list.
Where to go next
- Multi-factor authenticationGlossary
- Passwordless authenticationGlossary
- Password-based authenticationThe 12, 8 and 6 character rules
- Secure Configuration requirementsThe control this question tests
- All A5 questionsSecure configuration
- Cyber Essentials checklistThe evidence to gather for every question
- Check your readinessScore your answers, auto-fails first
Other A5 questions
- A5.3A5.3Yes/NoHave you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based a…Yes/No
- A5.4A5.4Yes/NoDo you run or host external services that provide access to data (that shouldn't be made public) to users across the internet?Yes/No
- A5.6A5.6NotesDescribe the process in place for changing passwords on your external services when you believe they have been compromised.Notes
- A5.7A5.7Options A to CWhen not using multi-factor authentication, which option are you using to protect your external service from brute force attacks?Options A to C
Frequently asked questions
A5.5 in the 2026 Danzell Cyber Essentials question set asks: "If yes to question A5.4, which authentication option do you use? A. Multi-factor authentication, with a minimum password length of 8 characters and no maximum length B. Automatic blocking of common passwords, with a minimum password length of 8 characters and no maximum length C. A minimum password length of 12 characters and no maximum length D. Passwordless, please describe E. None of the above, please describe" It is a multiple choice question with options A to E.
A5.5 asks which control protects logins to the external service you declared in A5.4. Options A to D pass: MFA with a password of at least 8 characters, automatic blocking of common passwords with at least 8 characters, a 12-character minimum, or passwordless authentication you describe. Option E, none of the above, does not meet the requirement.
No. A5.5 is not an automatic-fail question. A non-compliant or unclear answer may be returned by the assessor for more information, but the requirement behind it must still be met before the assessment can pass.
Software you run or host that lets staff or customers reach non-public data across the internet: a VPN server, a mail server, an internally hosted web application, or a SaaS or PaaS product you provide to customers. Third-party services you subscribe to are handled under A2.9 and A7.14 instead.
MFA is itself one of the accepted brute-force protections, so if every login to the service uses MFA you have met the requirement. A5.7 is phrased 'when not using multi-factor authentication', so answer it for any login path that does not have MFA.
Only if the password meets option B or C (8 characters with a deny list, or 12 characters) and brute force is prevented by throttling or lockout. MFA on the VPN is strongly preferred and is what most assessors expect to see.
Yes. Option D requires the notes field. State the method (passkeys, FIDO2 keys, certificates), where it is enforced and what the fallback is, so the assessor can confirm no weaker password path remains.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh